# Sitecore CMS vulnerabilities Source: https://junglewise.ai/threats/technologies/cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 53 vulnerabilities in Sitecore CMS: 0 in the last 7 days and 36 in the last 90 days, 6 of them critical and 2 exploited in the wild. The most recent, CVE-2026-92970, was published on 17 September 2026. Nothing in the last four weeks, down from 9 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 36 - All time: 53 (6 critical, 2 exploited in the wild) ## About Sitecore CMS Content management system by Sitecore for building and managing digital experiences. ## Latest Sitecore CMS vulnerabilities - [CVE-2026-92970: HUBzero CMS path traversal in project file upload](https://junglewise.ai/threats/cve-2026-92970-hubzero-cms-path-traversal-in-project-file-upload) (high, CVSS 8.8, published 17 Sep 2026) - [CVE-2026-92594: Craft CMS GraphQL authorization bypass in draftCreator and revisionCreator fields](https://junglewise.ai/threats/cve-2026-92594-craft-cms-graphql-authorization-bypass-in-draftcreator-and) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-92593: Craft CMS authenticated server-side template injection](https://junglewise.ai/threats/cve-2026-92593-craft-cms-authenticated-server-side-template-injection) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-92592: Craft CMS authenticated remote code execution via signed-cookie confusion](https://junglewise.ai/threats/cve-2026-92592-craft-cms-authenticated-remote-code-execution-via-signed-cookie) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-92591: Craft CMS environment secrets exposure during database outage](https://junglewise.ai/threats/cve-2026-92591-craft-cms-environment-secrets-exposure-during-database-outage) (medium, CVSS 5.9, published 16 Sep 2026) - [CVE-2026-92590: Craft CMS stored cross-site scripting in Generated Fields](https://junglewise.ai/threats/cve-2026-92590-craft-cms-stored-cross-site-scripting-in-generated-fields) (medium, CVSS 5.4, published 16 Sep 2026) - [CVE-2026-92589: Craft CMS broken access control in nested-elements reorder](https://junglewise.ai/threats/cve-2026-92589-craft-cms-broken-access-control-in-nested-elements-reorder) (medium, CVSS 4.3, published 16 Sep 2026) - [CVE-2026-90709: Yot CMS code injection in Admin Console eval](https://junglewise.ai/threats/cve-2026-90709-yot-cms-code-injection-in-admin-console-eval) (medium, CVSS 4.7, published 14 Sep 2026) - [CVE-2026-90708: Yot CMS SQL injection in cookie auto-login handler](https://junglewise.ai/threats/cve-2026-90708-yot-cms-sql-injection-in-cookie-auto-login-handler) (high, CVSS 7.3, published 14 Sep 2026) - [CVE-2026-87930: MaxSite CMS unsafe deserialization of session cookies](https://junglewise.ai/threats/cve-2026-87930-maxsite-cms-unsafe-deserialization-of-session-cookies) (high, CVSS 8.1, published 9 Sep 2026) - [CVE-2026-87929: MaxSite CMS hardcoded session encryption key auth bypass](https://junglewise.ai/threats/cve-2026-87929-maxsite-cms-hardcoded-session-encryption-key-auth-bypass) (critical, CVSS 9.8, published 9 Sep 2026) - [CVE-2026-87928: MaxSite CMS stored cross-site scripting in admin upload handler](https://junglewise.ai/threats/cve-2026-87928-maxsite-cms-stored-cross-site-scripting-in-admin-upload-handler) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-87927: MaxSite CMS local file inclusion via base64 path traversal](https://junglewise.ai/threats/cve-2026-87927-maxsite-cms-local-file-inclusion-via-base64-path-traversal) (high, CVSS 8.2, published 9 Sep 2026) - [CVE-2026-86731: Craft CMS missing admin-target guard in user activation](https://junglewise.ai/threats/cve-2026-86731-craft-cms-missing-admin-target-guard-in-user-activation) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-86730: Craft CMS behavior injection in field-layout elements](https://junglewise.ai/threats/cve-2026-86730-craft-cms-behavior-injection-in-field-layout-elements) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-86308: light0011 CMS information disclosure in debug mode](https://junglewise.ai/threats/cve-2026-86308-light0011-cms-information-disclosure-in-debug-mode) (medium, CVSS 5.3, published 7 Sep 2026) - [CVE-2026-86307: light0011 CMS cross-site request forgery](https://junglewise.ai/threats/cve-2026-86307-light0011-cms-cross-site-request-forgery) (medium, CVSS 4.3, published 7 Sep 2026) - [CVE-2026-86306: light0011 CMS improper authentication in cookie handling](https://junglewise.ai/threats/cve-2026-86306-light0011-cms-improper-authentication-in-cookie-handling) (high, CVSS 7.3, published 7 Sep 2026) - [CVE-2026-86305: light0011 cms unrestricted file upload in Upload::upload](https://junglewise.ai/threats/cve-2026-86305-light0011-cms-unrestricted-file-upload-in-upload-upload) (high, CVSS 7.3, published 7 Sep 2026) - [CVE-2026-85382: light0011 CMS stored cross-site scripting in article content](https://junglewise.ai/threats/cve-2026-85382-light0011-cms-stored-cross-site-scripting-in-article-content) (medium, CVSS 4.3, published 4 Sep 2026) - [CVE-2026-85381: light0011 CMS authorization bypass in Chapter Controller](https://junglewise.ai/threats/cve-2026-85381-light0011-cms-authorization-bypass-in-chapter-controller) (medium, CVSS 5.3, published 4 Sep 2026) - [CVE-2026-85380: light0011 cms server-side request forgery in UEditor](https://junglewise.ai/threats/cve-2026-85380-light0011-cms-server-side-request-forgery-in-ueditor) (high, CVSS 7.3, published 4 Sep 2026) - [CVE-2026-85379: light0011 cms SQL injection in article search](https://junglewise.ai/threats/cve-2026-85379-light0011-cms-sql-injection-in-article-search) (high, CVSS 7.3, published 4 Sep 2026) - [CVE-2026-85378: light0011 cms authorization bypass in Chapter Controller](https://junglewise.ai/threats/cve-2026-85378-light0011-cms-authorization-bypass-in-chapter-controller) (high, CVSS 7.3, published 3 Sep 2026) - [CVE-2026-79990: Craft CMS GraphQL entry mutation site scope bypass](https://junglewise.ai/threats/cve-2026-79990-craft-cms-graphql-entry-mutation-site-scope-bypass) (info, published 2 Sep 2026) ## Most severe Sitecore CMS vulnerabilities - [CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability](https://junglewise.ai/threats/cve-2019-9874-sitecore-cms-and-experience-platform-xp-deserialization) (critical, exploited in the wild, CVSS 9.8, published 26 Mar 2025) - [CVE-2019-9875: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability](https://junglewise.ai/threats/cve-2019-9875-sitecore-cms-and-experience-platform-xp-deserialization) (critical, exploited in the wild, CVSS 8.8, published 26 Mar 2025) - [CVE-2026-70553: MaxSite CMS remote code execution in install endpoint](https://junglewise.ai/threats/cve-2026-70553-maxsite-cms-remote-code-execution-in-install-endpoint) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-70552: MaxSite CMS authentication bypass in AJAX dispatcher](https://junglewise.ai/threats/cve-2026-70552-maxsite-cms-authentication-bypass-in-ajax-dispatcher) (critical, CVSS 9.8, published 4 Aug 2026) - [CVE-2026-87929: MaxSite CMS hardcoded session encryption key auth bypass](https://junglewise.ai/threats/cve-2026-87929-maxsite-cms-hardcoded-session-encryption-key-auth-bypass) (critical, CVSS 9.8, published 9 Sep 2026) - [CVE-2026-84795: Craft CMS privilege escalation via admin flag inheritance in user registration](https://junglewise.ai/threats/cve-2026-84795-craft-cms-privilege-escalation-via-admin-flag-inheritance-in-user) (critical, CVSS 9.8, published 2 Sep 2026) - [CVE-2026-92970: HUBzero CMS path traversal in project file upload](https://junglewise.ai/threats/cve-2026-92970-hubzero-cms-path-traversal-in-project-file-upload) (high, CVSS 8.8, published 17 Sep 2026) - [CVE-2026-86730: Craft CMS behavior injection in field-layout elements](https://junglewise.ai/threats/cve-2026-86730-craft-cms-behavior-injection-in-field-layout-elements) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-92592: Craft CMS authenticated remote code execution via signed-cookie confusion](https://junglewise.ai/threats/cve-2026-92592-craft-cms-authenticated-remote-code-execution-via-signed-cookie) (high, CVSS 8.8, published 16 Sep 2026) - [CVE-2026-92593: Craft CMS authenticated server-side template injection](https://junglewise.ai/threats/cve-2026-92593-craft-cms-authenticated-server-side-template-injection) (high, CVSS 8.8, published 16 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 9 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 15 | 1 | 0 | | 7 Sep 2026 | 10 | 1 | 0 | | 14 Sep 2026 | 9 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Sitecore technologies - [Sitecore Experience Platform (XP)](https://junglewise.ai/threats/technologies/experience-platform-xp): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Sitecore CMS vulnerabilities", https://junglewise.ai/threats/technologies/cms, 10 November 2026.