How many sitecore experience manager CVEs are in CISA KEV?

Yes — 1 of sitecore experience manager's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of sitecore experience manager are affected?

23 distinct sitecore experience manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in sitecore experience manager CVEs?

sitecore experience manager's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-502 (Deserialization of Untrusted Data), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')).

How many critical sitecore experience manager vulnerabilities are there?

sitecore experience manager has 3 critical and 8 high-severity CVEs.

What is the average severity of sitecore experience manager CVEs?

The average CVSS base score across sitecore experience manager's scored CVEs is 8.5.

sitecore experience manager Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: sitecore experience manager vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

sitecore experience manager Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

sitecore experience manager has 11 published CVE records since 2023, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 11 have a known public exploit. The average CVSS base score across scored CVEs is 8.5.

Severity and exploitation

How the CVSS severity of sitecore experience manager's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical3

High8

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

One of sitecore experience manager's CVEs is confirmed exploited in the wild.

Public exploits

11 of sitecore experience manager's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every sitecore experience manager version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

9.0 <= v <= 10.45 CVEs
<= 10.31 CVE
<= 9.01 CVE
10.0 <= v <= 10.41 CVE
10.1 <= v < 10.1.41 CVE
10.1 <= v < 10.1.4 rev. 011974 PRE1 CVE
10.3 <= v < 10.3.31 CVE
10.3 <= v < 10.3.3 rev. 011967 PRE1 CVE
10.4 <= v < 10.4.11 CVE
10.4 <= v < 10.4.1 rev. 011941 PRE1 CVE
8.0 <= v < 10.41 CVE

Common weakness types

The CWE weakness categories most often found in sitecore experience manager CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many sitecore experience manager CVEs were published each year.

2023

2024

2025

Other sitecore products

Browse vulnerabilities for other products by sitecore.

experience platform23 CVEs managed cloud11 CVEs cms10 CVEs experience commerce10 CVEs Experience Platform (XP)9 CVEs Sitecore Experience Manager (XM)5 CVEs Sitecore Experience Platform (XP)5 CVEs

Frequently asked questions

Common questions about sitecore experience manager vulnerabilities.

How many CVEs does sitecore experience manager have?: sitecore experience manager has 11 published CVE records since 2023.
How many sitecore experience manager CVEs are in CISA KEV?: Yes — 1 of sitecore experience manager's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for sitecore experience manager vulnerabilities?: Yes — 11 of sitecore experience manager's CVEs have a known public exploit.
Which versions of sitecore experience manager are affected?: 23 distinct sitecore experience manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in sitecore experience manager CVEs?: sitecore experience manager's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-502 (Deserialization of Untrusted Data), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')).
How many critical sitecore experience manager vulnerabilities are there?: sitecore experience manager has 3 critical and 8 high-severity CVEs.
What is the average severity of sitecore experience manager CVEs?: The average CVSS base score across sitecore experience manager's scored CVEs is 8.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track sitecore experience manager vulnerabilities

Get an alert for each new sitecore experience manager CVE, with AI-written analysis and remediation steps.

Create an account See pricing