CVE-2019-9874: Sitecore CMS/XP AntiCSRF module .NET deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with CVSS 9.8, KEV listing, and very high EPSS probability makes this an urgent patch-first issue.

What it is

The Sitecore.Security.AntiCSRF module in Sitecore CMS 7.0-7.2 and Sitecore XP 7.5-8.2 deserializes untrusted data from the HTTP POST parameter __CSRFTOKEN. An unauthenticated attacker can send a crafted serialized .NET object to that parameter and achieve remote code execution. The flaw is trivially reachable over the network and requires no credentials or user interaction.

Impact

An attacker gains arbitrary code execution on the Sitecore web server, typically under the application pool identity. This allows full compromise of the CMS host, data theft, and lateral movement into the hosting environment.

Attack surface

Reached over the network via an HTTP POST to the Sitecore application, with the payload placed in the __CSRFTOKEN parameter. No authentication and no user interaction are required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2019-9874 is listed in CISA KEV (added 2025-03-26) and has an EPSS 30-day probability of 0.837 (99.7th percentile), indicating active exploitation. Public exploit and patch detail is referenced in the Synacktiv advisory, and KEV notes no known ransomware campaign use.

What to do

• Apply the vendor patch or upgrade to a supported Sitecore release per Sitecore downloads and advisory guidance.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and vendor mitigations, or discontinue use of the affected product.
• Restrict network access to Sitecore instances so they are not directly reachable from untrusted networks.
• Monitor and block POST requests carrying serialized .NET object payloads in the __CSRFTOKEN parameter at the WAF or reverse proxy.
• Rotate secrets and review server integrity after any suspected exposure, since RCE implies full host compromise.

Detection

• Inspect HTTP POST bodies for __CSRFTOKEN values containing .NET serialization markers such as TypeConfuseDelegate, ObjectStateFormatter, or BinaryFormatter signatures.
• Alert on unexpected child processes spawned by the Sitecore application pool (w3wp.exe), especially cmd.exe, powershell.exe, or net.exe.
• Review web server and Sitecore logs for anomalous POST requests to endpoints handling the AntiCSRF module.
• Hunt for outbound connections or file writes from the Sitecore host that do not match normal CMS behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.