Sitecore CVE-2019-9874/9875: Anti-CSRF Deserialization RCE

What to do

1. Inventory every Sitecore instance, including old marketing microsites, and record the exact version and update level.
2. On 6.6 to 8.2, confirm SC Hotfix 313001-1 by comparing the SHA256 of bin\Sitecore.Security.AntiCsrf.dll with the value in Sitecore's bulletin; on 9.0 to 9.1 Initial Release, apply 313001-2 or upgrade.
3. Restrict /sitecore/shell to trusted IP addresses with IIS rules, or deny it entirely on content-delivery servers.
4. Plan upgrades off Sitecore 8.x and early 9.x, which also carry later flaws such as the sample machine key issue CVE-2025-53690.
5. If a site was unpatched and exposed, run the hunt below and rotate credentials stored in its connection strings.

How to check if you are affected or compromised

• Search IIS logs for POST requests to /sitecore/shell/ paths, such as /sitecore/shell/Applications/Security/CreateNewUser/CreateNewUser.aspx, from unknown sources.
• Search Sitecore and ASP.NET error logs for PotentialCsrfException entries such as 'The CSRF cookie value did not match the CSRF parameter value', which the public exploit triggers.
• Look for w3wp.exe spawning powershell.exe or cmd.exe, and for unexpected .aspx files or Sitecore admin users created since 2019.

What happened#

In February 2019, Synacktiv consultants found a remote code execution bug in Sitecore's anti-CSRF module during a customer assessment. Their advisory explains it. Sitecore.Security.AntiCsrf.dll took the __CSRFTOKEN POST parameter and deserialized it with .NET's ObjectStateFormatter, with no signature check, before comparing it with the __CSRFCOOKIE cookie. A ysoserial.net gadget posted to a page such as /sitecore/shell/Applications/Security/CreateNewUser/CreateNewUser.aspx therefore runs commands on the server. On Sitecore 8.x this needs no login. On 9.x before 9.1 Update-1 it needs an authenticated user.

Sitecore fixed the unauthenticated case on March 1, 2019 with bulletin SC2019-002-312864 and SC Hotfix 313001-1. Sitecore XP 9.1 Update-1 followed on April 5, and Synacktiv published on April 16. The CVEs went public on May 31, 2019. CVE-2019-9874 is the unauthenticated bug, scored 9.8 by NVD. CVE-2019-9875 is the authenticated one, scored 8.8 by NVD. On March 30, 2020, Sitecore updated its bulletin: "Recently, Sitecore has become aware of active exploitation of this Critical vulnerability." Days later, on April 2, 2020, it issued SC2020-002-293863, a hotfix for the authenticated 9.x variant.

CISA added both to the KEV catalog on March 26, 2025, six years after the fix. CISA did not explain the timing, and we found no public report of a new 2025 campaign as of October 23, 2026. Two facts are on the record. Sitecore had acknowledged exploitation in 2020. And on March 24, 2025, two days before the listing, Sitecore added the CVE IDs to both bulletins, which had not cited them before. Ransomware use is listed as unknown.

Who is affected#

For CVE-2019-9874, Sitecore lists CMS 6.6.3 through XP 8.2.7, in every mode and server role, including Managed Cloud. For CVE-2019-9875, it lists XP 9.0 Initial Release, 9.0 Update-1 and Update-2, and 9.1 Initial Release. XP 9.1 Update-1 and later, and xDB Cloud, are not affected.

Do you really need to act?#

Only if you still run old Sitecore, but those sites are common. Enterprise marketing sites often run for years on an unchanged 8.x build. The unauthenticated bug needs a single POST and uses a public tool, and Sitecore has confirmed exploitation since 2020. Check for the hotfix rather than assuming it. Old 8.x and early 9.x sites have other known problems too, such as the sample machine key ViewState flaw CVE-2025-53690.

What to do now#

1. Inventory every Sitecore instance, including forgotten microsites, and record the version.
2. On 6.6 to 8.2, verify Hotfix 313001-1. Run Get-FileHash .\bin\Sitecore.Security.AntiCsrf.dll -Algorithm SHA256 and compare the result with the bulletin. On 9.0 to 9.1 Initial Release, apply 313001-2 or upgrade.
3. Restrict /sitecore/shell to trusted IPs with IIS authorization rules, or deny it on delivery servers.
4. Plan upgrades off 8.x and early 9.x.

How to tell if you were hit#

Search IIS logs for POSTs to /sitecore/shell/ pages from unknown sources. Search Sitecore logs for PotentialCsrfException errors such as "The CSRF cookie value did not match the CSRF parameter value." The public exploit triggers that error even when it succeeds. On the server, look for w3wp.exe starting powershell.exe or cmd.exe, unknown .aspx files and unexpected Sitecore admins.

Timeline#

• Feb 20, 2019 — Synacktiv reports the bugs to Sitecore.
• Mar 1, 2019 — Sitecore publishes SC2019-002-312864 and Hotfix 313001-1.
• Apr 5, 2019 — Sitecore XP 9.1 Update-1 is released.
• May 31, 2019 — CVE-2019-9874 and CVE-2019-9875 are published.
• Mar 30, 2020 — Sitecore reports active exploitation.
• Mar 26, 2025 — CISA adds both CVEs to KEV.

Vulnerability records

• CVE-2019-9874 · KEV 2025-03-26 · Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an…
• CVE-2019-9875 · KEV 2025-03-26 · Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Sitecore — Security Bulletin SC2019-002-312864 (KB0334035) support.sitecore.com
2. Sitecore — Security Bulletin SC2020-002-293863 (KB0038556) support.sitecore.com
3. Synacktiv — Unsafe Object Deserialization in Sitecore <= 9.1.0 synacktiv.com
4. CVE record — CVE-2019-9874 cve.org
5. CVE record — CVE-2019-9875 cve.org
6. NVD — CVE-2019-9874 nvd.nist.gov
7. NVD — CVE-2019-9875 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2019-9874 cisa.gov
9. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Mar 26, 2025) cisa.gov