CVE-2021-42237

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jul 9, 2026

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://blog.assetnote.io/2021/11/02/sitecore-rce/Exploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776Vendor Advisory
http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
https://blog.assetnote.io/2021/11/02/sitecore-rce/Exploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237US Government Resource

Timeline

Published: Nov 5, 2021
Last modified: Jul 9, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-422429.8A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.CVE-2021-422446.1A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a c CVE-2021-422456.1FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.CVE-2021-42258.8The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plu CVE-2021-422506.5Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or CVE-2021-422527.8An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers a CVE-2021-422547.8BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-422557.8AppGuard Enterprise before 6.7.100.1 creates a Temporary File in a Directory with Insecure Permissions. Local users can gain SYSTEM privileg CVE-2021-422577.1check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device pat CVE-2021-422589.8BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th CVE-2021-42269.8RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is impleme CVE-2021-422607.5TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggere