Actively exploited in the wild
Sitecore XP Remote Command Execution Vulnerability
Sitecore - XP · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-42237
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in Sitecore XP from version 7.5 to 8.2 Update-7 allows remote code execution through insecure deserialization. No authentication or special configuration is required to exploit this flaw.
Risk Assessment
The organization is at risk of complete server compromise by an unauthenticated attacker, potentially leading to data theft, malware installation, or service disruption.
Recommendation
Immediately upgrade Sitecore XP to version 8.2 Update-8 or later, which includes a fix for the insecure deserialization vulnerability.
Original NVD description (English source)
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.