Loading vulnerability…
CVE-2025-27218 is an insecure deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 prior to KB1002844. The thumbnail-request authentication pipeline accepts the attacker-controlled ThumbnailsAccessToken HTTP header and passes it to MachineKeyTokenService.IsTokenValid. That routine Base64-decodes and deserializes the supplied value through .NET BinaryFormatter before applying MachineKey token validation or decryption. A crafted serialized object can therefore execute during deserialization before the token is rejected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module targeting CVE-2025-27218, a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) version 10.4. The exploit works by sending a specially crafted Base64-encoded BinaryFormatter payload in the 'Thumbnailsaccesstoken' HTTP header to a Sitecore server. The module supports both direct Windows command execution and PowerShell stager payloads, enabling remote code execution on the target Windows system. The module includes a check method to verify if the target is running Sitecore by inspecting the HTML title of the root page. The exploit is weaponized, allowing for customizable payloads and is suitable for operational use. The only file in the repository is a Ruby script structured as a standard Metasploit exploit module, leveraging Metasploit's HTTP client and deserialization utilities.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A pre-authentication remote code execution vulnerability in Sitecore 10.4 caused by unsafe BinaryFormatter deserialization. An unauthenticated attacker can supply a malicious serialized payload in the ThumbnailsAccessToken HTTP header, which reaches BinaryFormatter.Deserialize before token data is decrypted or otherwise validated.
A previously disclosed Sitecore deserialization vulnerability mentioned as part of a pattern of recent Sitecore flaws.
A previous Sitecore deserialization vulnerability referenced as similar to CVE-2025-53690, involving serialized objects accepted via HTTP headers or parameters such as ThumbnailsAccessToken.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.