Critical severity9.8CISA KEVNVD Advisory· Published Nov 5, 2021· Updated Jul 9, 2026
CVE-2021-42237
CVE-2021-42237
Description
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
26cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*+ 23 more
- cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:7.5:update1:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:7.5:update2:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:-:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update1:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update3:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update4:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update5:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update6:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.0:update7:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.1:-:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.1:update1:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.1:update2:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.1:update3:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:-:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update1:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update2:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update3:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update4:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update5:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update6:*:*:*:*:*:*
- cpe:2.3:a:sitecore:experience_platform:8.2:update7:*:*:*:*:*:*
- Sitecore/Sitecore XPdescription
- Range: 7.5 Initial Release to 8.2 Update-7
Patches
Vulnerability mechanics
References
4- blog.assetnote.io/2021/11/02/sitecore-rce/nvdExploitThird Party Advisory
- packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.htmlnvdThird Party AdvisoryVDB Entry
- support.sitecore.com/kbnvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.