{"id":"CVE-2023-35813","aliases":["EUVD-2023-39808","GHSA-q6mf-24rq-66wc"],"status":"published","title":"Multiple Sitecore products allow remote code execution. This affects Experience Manager,...","description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.86685,"percentile":0.99744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2023-06-17T00:00:00Z","modified":"2026-06-17T06:05:15Z","exploits":[{"source":"nuclei","id":"CVE-2023-35813","title":"Sitecore - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-35813.yaml"},{"source":"pocgithub","id":"BagheeraAltered/CVE-2023-35813-PoC","title":"BagheeraAltered/CVE-2023-35813-PoC","date":"2024-01-15","url":"https://github.com/BagheeraAltered/CVE-2023-35813-PoC"},{"source":"pocgithub","id":"Rezy-Dev/CVE-2023-35813","title":"Rezy-Dev/CVE-2023-35813","date":"2025-11-30","url":"https://github.com/Rezy-Dev/CVE-2023-35813"},{"source":"pocgithub","id":"aalexpereira/CVE-2023-35813","title":"aalexpereira/CVE-2023-35813","date":"2023-12-31","url":"https://github.com/aalexpereira/CVE-2023-35813"},{"source":"pocgithub","id":"her3ticAVI/CVE-2023-35813","title":"her3ticAVI/CVE-2023-35813","date":"2025-11-11","url":"https://github.com/her3ticAVI/CVE-2023-35813"},{"source":"pocgithub","id":"nmlz/CVE-2023-35813_PoC","title":"nmlz/CVE-2023-35813_PoC","date":"2026-05-27","url":"https://github.com/nmlz/CVE-2023-35813_PoC"}],"products":[{"vendor":"sitecore","product":"experience_commerce"},{"vendor":"sitecore","product":"experience_manager"},{"vendor":"sitecore","product":"experience_platform"},{"vendor":"sitecore","product":"managed_cloud"}],"references":[{"url":"https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1002979","tags":["x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35813"},{"url":"https://github.com/advisories/GHSA-q6mf-24rq-66wc"}],"sources":{"cve":[{"id":"CVE-2023-35813","description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.","status":"published","published":"2023-06-17T00:00:00Z","modified":"2024-12-17T16:20:49.395Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-39808","description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.","status":"published","published":"2023-06-17T00:00:00Z","modified":"2024-12-17T16:20:49Z","updated_at":"2026-11-03T00:04:34.500778Z"}],"ghsa":[{"id":"GHSA-q6mf-24rq-66wc","title":"Multiple Sitecore products allow remote code execution. This affects Experience Manager,...","description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.","status":"published","published":"2023-06-18T00:30:21Z","modified":"2024-12-17T18:33:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:59:13.042537Z"}],"nvd":[{"id":"CVE-2023-35813","description":"Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.","status":"published","published":"2023-06-17T23:15:09.137Z","modified":"2026-06-17T06:05:15.583Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:08:06.335469Z"}]}}