Loading story…
Sitecore Experience Platform (XP) versions 7.5 through 8.2 Update-7 are affected by CVE-2021-42237, an unauthenticated insecure-deserialization flaw in the /sitecore/shell/ClientBin/Reporting/Report.ashx reporting endpoint. A remote attacker can exploit the exposed endpoint to execute arbitrary commands with the privileges of the Sitecore host, creating an initial-access route into connected Windows systems and domains.
Sitecore advised customers to remove the unused Report.ashx file from every server instance and to upgrade affected deployments; installations running XP 7.5 were advised to move to XP 9.0.0 or later. Organizations should identify internet-exposed and internally reachable vulnerable Sitecore instances, confirm the endpoint has been removed, and investigate host activity for signs of unauthorized command execution.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Assetnote published a blog post detailing the Sitecore Report.ashx vulnerability, including a proof of concept using a crafted serialized payload to execute commands remotely.
Sitecore published an advisory for the unauthenticated Report.ashx insecure-deserialization issue affecting XP 7.5 through 8.2 Update-7. The remediation advised removing the unused Report.ashx file and, for some versions, upgrading.
Sitecore provided its initial response to Assetnote's report concerning the Report.ashx insecure-deserialization vulnerability.
Assetnote Security Research Team reported an unauthenticated insecure-deserialization vulnerability in Sitecore XP's Report.ashx endpoint to Sitecore. The flaw could enable remote command execution on affected hosts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourcesupport.sitecore.com
Open sourceblog.assetnote.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026
Sitecore published advisory **KB1003535** for **CVE-2025-27218**, a pre-authentication remote-code-execution flaw in Sitecore CMS 10.4. The vulnerability is rooted in unsafe .NET `BinaryFormatter` deserialization in the thumbnail-request authentication flow, enabling an unauthenticated attacker to target the Sitecore IIS application pool. The vulnerable path processes a user-controlled `ThumbnailsAccessToken` HTTP header and deserializes supplied data before validating or decrypting the token. A crafted Base64-encoded serialized payload can therefore execute attacker-controlled code on the server. Organizations running affected Sitecore deployments should apply Sitecore’s recommended patches and assess exposed instances for suspicious thumbnail requests and anomalous IIS application-pool activity.
Sep 3, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Aug 15, 2026