CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure...

9.8 CriticalIn KEVPublic exploit

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.6%Up 95.7 points since Nov 6, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-42237
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-502
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2021-42237
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2021-29215 9.8

Record: EUVD-2021-29215
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j3x5-fr4h-9v7v 9.8

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure...

Record: GHSA-j3x5-fr4h-9v7v
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

CISA KEV No score

Sitecore XP Remote Command Execution Vulnerability

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

Record: CVE-2021-42237
Weakness: CWE-502
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Sitecore Experience Platform (XP) PreAuth Deserialization RCE	2021-11-02
PoC in GitHub	ItsIgnacioPortal/CVE-2021-42237	2022-01-16
PoC in GitHub	vesperp/CVE-2021-42237-SiteCore-XP	2022-06-30
PoC in GitHub	crankyyash/SiteCore-RCE-Detection	2022-09-22
Nuclei	Sitecore Experience Platform Pre-Auth RCE

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-42237 is a critical vulnerability (CVSS 9.8) in Sitecore Xp, published November 5, 2021. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.6%, the 99th percentile. No source names a fixed version.