Loading story…
CVE-2024-46938 is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as web.config and Sitecore backup files, exposing application secrets.
Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin SC2024-001-619349, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Sitecore addressed CVE-2024-46938, an order-of-operations flaw enabling unauthenticated local-file disclosure in Sitecore CMS, through Security Bulletin SC2024-001-619349. The issue could expose web.config or backup files and potentially enable remote code execution if application secrets were obtained.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sitecore published advisory **KB1003535** for **CVE-2025-27218**, a pre-authentication remote-code-execution flaw in Sitecore CMS 10.4. The vulnerability is rooted in unsafe .NET `BinaryFormatter` deserialization in the thumbnail-request authentication flow, enabling an unauthenticated attacker to target the Sitecore IIS application pool. The vulnerable path processes a user-controlled `ThumbnailsAccessToken` HTTP header and deserializes supplied data before validating or decrypting the token. A crafted Base64-encoded serialized payload can therefore execute attacker-controlled code on the server. Organizations running affected Sitecore deployments should apply Sitecore’s recommended patches and assess exposed instances for suspicious thumbnail requests and anomalous IIS application-pool activity.
Sep 3, 2026
Sitecore Experience Platform (XP) versions 7.5 through 8.2 Update-7 are affected by **CVE-2021-42237**, an unauthenticated insecure-deserialization flaw in the `/sitecore/shell/ClientBin/Reporting/Report.ashx` reporting endpoint. A remote attacker can exploit the exposed endpoint to execute arbitrary commands with the privileges of the Sitecore host, creating an initial-access route into connected Windows systems and domains. Sitecore advised customers to remove the unused `Report.ashx` file from every server instance and to upgrade affected deployments; installations running XP 7.5 were advised to move to XP 9.0.0 or later. Organizations should identify internet-exposed and internally reachable vulnerable Sitecore instances, confirm the endpoint has been removed, and investigate host activity for signs of unauthorized command execution.
Sep 3, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Aug 15, 2026