CVE-2021-42237Sitecore XP Remote Command Execution Vulnerability

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

9.8 CRITICALEPSS 97.56%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2026-07-09 00:15 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2021-42237
Status: Published
Assigner (CNA): mitre
Published: Nov 5, 2021
Last modified: 2026-07-09 00:15 UTC
Weaknesses: CWE-502

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-07 14:12 UTC.