Loading story…
Sitecore published advisory KB1003535 for CVE-2025-27218, a pre-authentication remote-code-execution flaw in Sitecore CMS 10.4. The vulnerability is rooted in unsafe .NET BinaryFormatter deserialization in the thumbnail-request authentication flow, enabling an unauthenticated attacker to target the Sitecore IIS application pool.
The vulnerable path processes a user-controlled ThumbnailsAccessToken HTTP header and deserializes supplied data before validating or decrypting the token. A crafted Base64-encoded serialized payload can therefore execute attacker-controlled code on the server. Organizations running affected Sitecore deployments should apply Sitecore’s recommended patches and assess exposed instances for suspicious thumbnail requests and anomalous IIS application-pool activity.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers showed that a crafted Base64-encoded BinaryFormatter payload in the ThumbnailsAccessToken HTTP header can be deserialized before token validation in Sitecore 10.4. Their proof of concept used ysoserial.net to execute whoami under the Sitecore IIS application-pool identity and write the result to App_Data.
Sitecore issued an advisory identifying affected versions of its CMS and recommending patches for CVE-2025-27218, a pre-authentication remote-code-execution flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceassetnote.io
Open sourcesupport.sitecore.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-46938** is an order-of-operations flaw affecting Sitecore CMS 8.x through 10.x that allows unauthenticated attackers to read arbitrary local files when they know, or can infer, the product’s absolute installation path. Attackers can use the issue to retrieve sensitive files such as `web.config` and Sitecore backup files, exposing application secrets. Disclosed ASP.NET machine keys or Telerik encryption keys can be leveraged for .NET ViewState deserialization and ultimately remote code execution. Sitecore addressed the issue in August 2024 in Security Bulletin **SC2024-001-619349**, but internet-exposed deployments may remain susceptible if unpatched; organizations should apply the vendor update and assess exposed instances for secret disclosure and potential compromise.
Sep 3, 2026
Sitecore Experience Platform (XP) versions 7.5 through 8.2 Update-7 are affected by **CVE-2021-42237**, an unauthenticated insecure-deserialization flaw in the `/sitecore/shell/ClientBin/Reporting/Report.ashx` reporting endpoint. A remote attacker can exploit the exposed endpoint to execute arbitrary commands with the privileges of the Sitecore host, creating an initial-access route into connected Windows systems and domains. Sitecore advised customers to remove the unused `Report.ashx` file from every server instance and to upgrade affected deployments; installations running XP 7.5 were advised to move to XP 9.0.0 or later. Organizations should identify internet-exposed and internally reachable vulnerable Sitecore instances, confirm the endpoint has been removed, and investigate host activity for signs of unauthorized command execution.
Sep 3, 2026
Researchers disclosed multiple **BMC FootPrints ITSM** vulnerabilities that can be chained to achieve **pre-authenticated remote code execution**, highlighting the product as a high-value target because ITSM platforms often contain asset inventories, incident data, configuration details, and other operationally sensitive information. *watchTowr Labs* said it found and chained flaws in 2025 against what was then a fully patched deployment, while broader reporting noted a set of four issues affecting the platform and framed the exposure as part of a wider pattern of attackers abusing enterprise management software. A related disclosure, **CVE-2025-71260**, affects BMC FootPrints versions `20.20.02` through `20.24.01.001` and stems from unsafe ASP.NET `VIEWSTATE` deserialization, allowing an authenticated attacker to execute arbitrary code and fully compromise the application. The vendor has issued hotfixes for affected releases, but the references do not all describe the exact same exploit chain: the watchTowr research focuses on **pre-auth RCE chains**, while the CVE entry covers a specific **authenticated** deserialization bug, making it adjacent but not fully the same incident thread.
Jun 29, 2026