CVE-2019-10068VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2019-10068: Kentico Xperience Deserialization of Untrusted Data Vulnerability

Affects Kentico XperienceSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 95.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-10068 (opens in a new tab)

Description

Kentico Xperience contains a vulnerability due to failure to validate security headers, leading to deserialization of untrusted data. This flaw can allow unauthenticated remote code execution. The vulnerability is known to be exploited in the wild and is classified as high severity.

Summary

CVE-2019-10068 is a vulnerability in Kentico Xperience where improper validation of security headers allows deserialization of untrusted data. This can result in unauthenticated remote code execution, enabling attackers to execute arbitrary code on affected systems. The vulnerability is associated with CWE-502 (Deserialization of Untrusted Data) and has been observed to be exploited in the wild.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code remotely on vulnerable Kentico Xperience installations. This can lead to full system compromise depending on the privileges of the application process.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider mitigating controls such as restricting access to vulnerable services until a fix is available.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:57:25 UTC

Weaknesses

References

Related threats