Sitecore
4 Sitecore flaws are on CISA's list of vulnerabilities attackers have used, 0 of them added in 2026. CISA says 1 is known to be used by ransomware. The latest was added Sep 4, 2025.
4on CISA's list, all time
0added in 2026
0in the last 90 days
1used by ransomware
1zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| CMS and Experience Platform (XP) | 2 | Mar 26, 2025 |
| Multiple Products | 1 | Sep 4, 2025 |
| XP | 1 | Mar 25, 2022 |
Latest Sitecore flaws
- Multiple ProductsSitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CMS and Experience Platform (XP)Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- XPSitecore XP Remote Command Execution Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.