CVE-2025-27218

What it actually does

The vulnerability is an insecure deserialization flaw in Sitecore Experience Manager and Experience Platform 10.4 before Sitecore hotfix KB1002844. A remote, unauthenticated attacker can send crafted serialized data to the application and cause the server-side .NET runtime to deserialize attacker-controlled objects. In practical exploitation, this can lead to execution of attacker-supplied commands in the context of the Sitecore application pool identity, enabling web shell deployment, credential theft, lateral movement, or manipulation of Sitecore-managed content and configuration.

Why it matters to the business

Successful exploitation can give an external attacker control over a public-facing Sitecore application, which may disrupt web operations, expose sensitive customer or content-management data, and create a foothold into connected internal systems. Although it is not currently listed in CISA KEV and is not specifically tagged as ransomware-used, the exploit is described as weaponized and the EPSS score is high, so organizations running affected Sitecore 10.4 deployments should treat remediation as urgent.

How an attack unfolds

An attacker first identifies an internet-accessible Sitecore XM or XP 10.4 instance and determines whether it is missing Sitecore hotfix KB1002844. The attacker then sends a specially crafted request containing malicious serialized .NET object data to a vulnerable Sitecore component. When the application deserializes that data without sufficient validation, gadget-chain behavior can be triggered and arbitrary commands may execute under the IIS worker process account. After achieving code execution, the attacker commonly attempts to establish persistence by writing an ASPX or ASHX web shell, executing PowerShell or cmd.exe through w3wp.exe, collecting configuration secrets from Sitecore files, accessing databases or search services using stored credentials, and using the compromised web server as a pivot point. Because public exploit capability is considered weaponized and the EPSS probability is elevated, exploitation attempts should be expected against exposed systems.

How to fix it

Apply Sitecore hotfix KB1002844 to all affected Sitecore Experience Manager and Experience Platform 10.4 deployments. If applying the hotfix immediately is not possible, reduce exposure by restricting access to Sitecore administrative and application endpoints, placing the application behind a WAF or reverse proxy with strict request filtering, blocking suspicious serialized payload patterns, and limiting outbound connectivity from the web tier. Ensure the IIS application pool identity has least-privilege access, remove unnecessary write permissions from web directories, and rotate Sitecore secrets, database credentials, API keys, and service account passwords if exploitation is suspected. After patching, remove any unauthorized web shells, scheduled tasks, startup items, or modified Sitecore files introduced during compromise.

How to confirm the fix worked

Confirm that every Sitecore XM or XP 10.4 instance has Sitecore hotfix KB1002844 installed according to Sitecore’s vendor instructions. Validate using application build metadata, deployed hotfix package records, file version checks, and change-management evidence. Re-test externally exposed Sitecore endpoints to confirm they no longer accept or process malicious serialized payloads. Review IIS and Sitecore logs after patching to verify that exploit attempts fail with safe errors and do not result in child process execution from w3wp.exe. Perform file integrity checks against the Sitecore web root and application directories to ensure no unauthorized ASPX, ASHX, DLL, config, or script files remain.

Typical attack path

1. Scan for public Sitecore XM or XP 10.4 deployments.
2. Fingerprint whether the instance appears to be missing hotfix KB1002844.
3. Send a crafted unauthenticated request containing malicious serialized .NET payload data.
4. Trigger unsafe deserialization inside the Sitecore application.
5. Execute commands under the IIS application pool identity, typically via w3wp.exe.
6. Drop or invoke a web shell, PowerShell payload, or other remote access mechanism.
7. Read Sitecore configuration files, connection strings, API keys, or service credentials.
8. Use the compromised server for persistence, data access, content tampering, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review IIS W3C access logs, Sitecore logs under the application log directory, Windows Security and PowerShell logs, Sysmon or EDR process telemetry, file integrity monitoring, and outbound proxy/firewall/DNS logs. Look for unauthenticated POST requests with unusually large or encoded payloads, deserialization-related exceptions, and request bursts followed by w3wp.exe launching command-line tools. Correlate suspicious web requests with process creation events from the IIS worker process, creation of ASPX or ASHX files in the Sitecore web root, modification of configuration files, and outbound network connections to unfamiliar hosts. Hunt for known .NET deserialization gadget indicators in request bodies and logs, including ObjectDataProvider, ActivitySurrogateSelector, TypeConfuseDelegate, BinaryFormatter, LosFormatter, ysoserial, and long Base64 strings. Because the exploit is weaponized and the vulnerability has been public for an extended period, use the longest available retention window and prioritize internet-facing Sitecore systems.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• System.Windows.Data.ObjectDataProvider
• System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
• System.Web.UI.LosFormatter
• System.Workflow.ComponentModel.ActivitySurrogateSelector
• TypeConfuseDelegate
• ysoserial.net
• ObjectDataProvider
• ActivitySurrogateSelector
• BinaryFormatter
• LosFormatter
• SerializationException
• The input stream is not a valid binary format
• Unable to find assembly
• Type is not resolved
• /App_Data/logs/
• *.aspx created under Sitecore web root
• *.ashx created under Sitecore web root
• /sitecore/shell/
• /sitecore/admin/

What your security team should do

• Prioritize patching all Sitecore XM and XP 10.4 deployments with KB1002844 because exploit maturity is weaponized and EPSS is high.
• Inventory all internet-facing Sitecore assets, including staging, authoring, content delivery, and disaster recovery instances.
• Temporarily restrict external access to non-public Sitecore functionality until patching and validation are complete.
• Search historical IIS, Sitecore, Windows Event, and EDR telemetry for exploitation attempts dating back to at least the public disclosure window, with broader lookback where logs are available.
• Hunt for w3wp.exe spawning command interpreters or scripting utilities such as cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, or rundll32.exe.
• Inspect Sitecore web roots and writable directories for recently created ASPX, ASHX, DLL, ZIP, config, or script files.
• Rotate credentials stored in Sitecore configuration files or accessible to the Sitecore application pool if compromise cannot be ruled out.
• Add WAF and SIEM detections for .NET deserialization payload indicators, suspicious long Base64 request bodies, and Sitecore application errors consistent with failed deserialization.
• Review outbound network connections from Sitecore servers for command-and-control, payload retrieval, or data exfiltration behavior.