# CVE-2019-9875

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

- Page: https://www.vulneraibility.com/cve/CVE-2019-9875
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-03-26; CISA due date 2025-04-16
- EPSS: 25.44%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-03-26)
- Weakness: CWE-502
- Published: 2019-05-31

## Affected

- sitecore:cms

## References

- [other] https://dev.sitecore.net/Downloads.aspx
- [other] https://www.synacktiv.com/blog.html
- [other] https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.