CVE-2019-9874

What is Sitecore Experience Platform?

Sitecore CMS and Experience Platform (XP) is an enterprise .NET-based content management and digital marketing platform used by large organizations to run public-facing websites, personalized marketing campaigns, and customer experience portals.

Overview

CVE-2019-9874 is a critical (CVSS 9.8) .NET deserialization vulnerability (CWE-502) in Sitecore's Sitecore.Security.AntiCSRF module. It allows a completely unauthenticated attacker to achieve remote code execution by submitting a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter — one of the more severe possible outcomes for a web application, requiring no valid session or credentials whatsoever.

Affected Versions

Technical Details

The AntiCSRF module deserializes attacker-supplied data from the __CSRFTOKEN POST field using unsafe .NET deserialization, without validating that the payload is a legitimate, expected object type. This is the classic insecure-deserialization pattern (CWE-502): by crafting a serialized "gadget chain" object using known .NET deserialization gadgets, an attacker can cause arbitrary code to execute the moment the server deserializes the malicious payload — before any authentication check is even reached.

Discovery

Sitecore published fix guidance in knowledge-base article KB0334035; the underlying deserialization pattern in .NET applications was extensively studied by the broader application-security research community around this period.

Exploitation Context

Despite being disclosed in 2019, this vulnerability saw renewed, confirmed active exploitation years later, leading CISA to add it to the KEV catalog in March 2025 — security researchers publishing analyses of legacy Sitecore deployments around that time found many installations still unpatched and reachable from the internet, making this an example of an old bug staying dangerous far past its original disclosure.

Remediation

1. Apply Sitecore's patch referenced in KB0334035 (or upgrade to a current, supported Sitecore XP release) without delay.
2. Because this bug predates many organizations' current Sitecore deployments, explicitly verify patch status rather than assuming a "modern" instance is unaffected.
3. Restrict direct internet access to Sitecore's administrative and API endpoints where feasible.
4. Monitor for unusual POST requests containing large or unusual __CSRFTOKEN values.
5. Given the multi-year gap between disclosure and confirmed exploitation, treat any internet-facing legacy Sitecore instance as high risk until confirmed patched.