CVE-2025-27218

Medium

Published: 20 February 2025

Published

20 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.7568 98.9th percentile

Risk Priority 56 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27218 is a medium-severity Code Injection (CWE-94) vulnerability in Sitecore Experience Manager (inferred from references). Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-27218 is a remote code execution vulnerability affecting Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 versions prior to KB1002844. The issue arises from insecure deserialization, mapped to CWE-94, enabling attackers to execute arbitrary code on affected systems. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network accessibility with low attack complexity.

Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction. Exploitation involves sending crafted serialized data, leading to remote code execution on the server, though the CVSS metrics reflect low confidentiality impact with no integrity or availability disruption.

Sitecore's knowledge base article at https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535 details the issue, with mitigation available via KB1002844, which addresses the insecure deserialization flaw in XM and XP 10.4.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4575

Vulnerability details

Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes an unauthenticated remote code execution vulnerability in the public-facing Sitecore XM/XP web application via insecure deserialization, directly enabling exploitation of public-facing applications for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0