Sitecore Experience Manager and Experience Platform Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.4 prior to KB1002844. This vulnerability arises from insecure deserialization, allowing for unauthorized code execution on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected server.

Remediation

To address this vulnerability, Sitecore users should apply the cumulative hotfix available in KB1002844 for version 10.4. For Managed Cloud customers running affected Experience Platform versions, the same hotfix should be applied. After applying the hotfix, verify that the version of the Sitecore.Kernel assembly is equal to or greater than 19.4.93.21984.