CVE-2019-11080

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

• CWE-502

• http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20NotesRelease Notes, Vendor Advisory
• https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCEExploit, Third Party Advisory
• http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20NotesRelease Notes, Vendor Advisory
• https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCEExploit, Third Party Advisory

Published

Jun 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11073A Remote Code Execution vulnerability exists in PRTG Network…7.2
• CVE-2019-11074A Write to Arbitrary Location in Disk vulnerability exists i…7.2
• CVE-2019-11076Cribl UI 1.5.0 allows remote attackers to run arbitrary comm…
• CVE-2019-11077FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to a…8.8
• CVE-2019-11078MKCMS V5.0 has a CSRF vulnerability to add a new admin user …
• CVE-2019-1108An information disclosure vulnerability exists when the Wind…
• CVE-2019-11081A default username and password in Dentsply Sirona Sidexis 4…
• CVE-2019-11082core/api/datasets/internal/actions/Explode.java in the Datas…
• CVE-2019-11084GAuth 0.9.9 beta has stored XSS that shows a popup repeatedl…
• CVE-2019-11085Insufficient input validation in Kernel Mode Driver in Intel…
• CVE-2019-11086Insufficient input validation in subsystem for Intel(R) AMT …6.8
• CVE-2019-11087Insufficient input validation in the subsystem for Intel(R) …6.7