CVE-2019-9875 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2019-05-31

Added to CISA KEV: 2025-03-26 2126 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update Sitecore to version 9.1.1 or later that addresses this deserialization vulnerability
Review web application logs for suspicious POST requests containing serialized objects or unusual anti-CSRF module activity
Implement network segmentation to limit access to Sitecore administrative interfaces
Monitor for unauthorized code execution, file system changes, or suspicious network connections from Sitecore servers
PATCH PRIORITY: CRITICAL - Immediate patching required due to active exploitation

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2019-9875 is a security vulnerability affecting Sitecore CMS and XP platforms ^[1]. Below is a summary of the known details regarding this vulnerability.

Vulnerability Overview

Description: The vulnerability is a "Deserialization of Untrusted Data" flaw located within the anti-CSRF (Cross-Site Request Forgery) module of Sitecore ^[1].
Impact: Successful exploitation allows an attacker to execute arbitrary code on the affected system ^[1].

Exploitation Details

Method: An attacker can trigger the vulnerability by sending a specially crafted, serialized .NET object within an HTTP POST parameter ^[1].
Requirements:

* Authentication: The vulnerability requires the attacker to be authenticated to the system to perform the attack ^[1]. * Access: It is a network-based attack, as it involves sending an HTTP request to the target server ^[1].

Active Exploitation & Campaigns: There is no widely publicized information indicating that this specific CVE has been a primary vector in major ransomware campaigns or targeted attacks in the wild. It is not typically highlighted in lists of "Known Exploited Vulnerabilities" (KEV) compared to more critical, unauthenticated remote code execution flaws.

Affected Versions & Mitigation

Affected Versions: Sitecore versions up to and including 9.1 are affected ^[1].
Status: Users of affected versions are generally advised to upgrade to a patched version of Sitecore or apply the security updates provided by the vendor to remediate the deserialization flaw. Organizations should consult official Sitecore security bulletins for the specific patch releases that address this issue.

Sources

CVE-2019-9875 Detail - NVD
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code. ... Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secu…