CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

• CWE-502
• CWE-502

• http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://blog.assetnote.io/2021/11/02/sitecore-rce/Exploit, Third Party Advisory
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776Vendor Advisory
• http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• https://blog.assetnote.io/2021/11/02/sitecore-rce/Exploit, Third Party Advisory
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237US Government Resource

Published

Nov 5, 2021

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42227Cross SIte Scripting (XSS) vulnerability exists in KindEdito…6.1
• CVE-2021-42228A Cross Site Request Forgery (CSRF) vulnerability exists in …8.8
• CVE-2021-42230Seowon 130-SLC router all versions as of 2021-09-15 is vulne…9.8
• CVE-2021-42232TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a c…9.8
• CVE-2021-42233The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to s…5.4
• CVE-2021-42235SQL injection in osTicket before 1.14.8 and 1.15.4 login and…9.8
• CVE-2021-42242A command execution vulnerability exists in jfinal_cms 5.0.1…9.8
• CVE-2021-42244A cross-site scripting (XSS) vulnerability in PaquitoSoftwar…6.1
• CVE-2021-42245FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerab…6.1
• CVE-2021-42248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4225The SP Project & Document Manager WordPress plugin before 4.…8.8
• CVE-2021-42250Improper output neutralization for Logs. A specific Apache S…6.5