CVE-2019-9875: Sitecore CMS anti-CSRF module .NET deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote code execution with public exploit code and active inclusion in CISA KEV makes this an urgent patching priority.

What it is

The anti-CSRF module in Sitecore CMS through 9.1 deserializes untrusted .NET objects supplied in an HTTP POST parameter. An authenticated attacker can send a crafted serialized object to trigger remote code execution. The flaw is a classic CWE-502 untrusted deserialization issue in a widely deployed enterprise CMS.

Impact

An attacker with a valid account gains arbitrary code execution on the Sitecore server, leading to full compromise of the host and any data or credentials it holds.

Attack surface

Reached over the network via an HTTP POST parameter handled by the anti-CSRF module. Authentication is required (PR:L) but no user interaction is needed, and the attack is low complexity.

Exploitation

CVE-2019-9875 is listed in CISA KEV with a 2025-04-16 remediation due date, and EPSS shows a 30-day probability of roughly 14 percent (96th percentile). A public third-party advisory tagged Exploit exists, so working exploit code is available.

What to do

• Apply the vendor patch or upgrade Sitecore CMS/XP to a fixed release per Sitecore guidance.
• If patching is not immediately possible, follow CISA BOD 22-01 required actions or discontinue use of the affected product.
• Restrict and monitor authenticated access to the CMS administrative and anti-CSRF endpoints.
• Enable .NET deserialization protections and block untrusted serialized object types where feasible.
• Rotate credentials and secrets stored on any host that may have been exposed.

Detection

• Monitor HTTP POST requests to Sitecore anti-CSRF endpoints for serialized .NET object payloads or base64 blobs.
• Alert on w3wp.exe or Sitecore processes spawning unexpected child processes such as cmd.exe or powershell.exe.
• Review authentication logs for anomalous or newly created accounts preceding suspicious POST activity.
• Hunt for known deserialization gadget type names in request bodies and web server logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.