CVE-2025-27218

Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization

Medium · published February 20, 2025

Patch now

High probability of exploitation

CVSS calls it medium at 5.3. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
5.3
EPSS
65%
Percentile
99.3
In the wild
Unconfirmed
What it is

Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.65003 · 99.3th percentile
Published
2025-02-20T00:00Z
EPSS history
Timeline
  • 20 FEB 00:00Z
    Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization
    cvelistv5