CVE DatabaseCVE-2019-10068

Updated 2026-06-17한국어 권고문 →

CVE-2019-100689.8/CRITICALCISA KEVCWE-502CWE-502

Kentico CMS Staging Service Authentication Bypass and .NET Deserialization Remote Code Execution (RCE) (CVE-2019-10068)

⚡ Jump to Patch

Affected Vendors

kentico

Affected Components

kentico_cms

Published Date

2019-03-26

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

95.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Kentico CMS versions 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and all 9.x versions

Impact

Unauthenticated remote attackers can bypass authentication and execute arbitrary .NET object deserialization, leading to full remote code execution on the host server

Mitigation

Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints

Affected Products & Version Scope

Kentico CMS 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official hotfixes provided by Kentico. If you manage dependencies via NuGet, update your packages to the patched versions using the Package Manager Console:

powershell

# Update Kentico NuGet packages to the secure version (e.g., 12.0.15)
Update-Package Kentico.Libraries -Version 12.0.15
Update-Package Kentico.Search -Version 12.0.15

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, restrict access to the Staging Service endpoint using IIS URL Rewrite rules in your Web.config file to block external traffic:

xml

<!-- Add this rule inside the <system.webServer> section of Web.config -->
<rewrite>
  <rules>
    <rule name='Restrict Staging Service' stopProcessing='true'>
      <match url='^CMSPages/Staging/.*' />
      <conditions>
        <!-- Block all IPs except the trusted internal subnet (e.g., 10.0.0.0/8) -->
        <add input='{REMOTE_ADDR}' pattern='^10\.' negate='true' />
      </conditions>
      <action type='CustomResponse' statusCode='403' statusReason='Forbidden' />
    </rule>
  </rules>
</rewrite>

3. Log Audit & IoC Verification Commands

Search your IIS W3C logs for suspicious POST requests directed at the staging service that returned a successful status code (200 OK):

powershell

# Search IIS logs for access to the SyncServer endpoint
Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*' | 
    Select-String -Pattern 'SyncServer.asmx' | 
    Where-Object { $_ -match 'POST' -and $_ -match ' 200 ' } | 
    Select-Object -First 20

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately apply the vendor hotfix or restrict access to the staging endpoints.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Staging Service of Kentico CMS, which is responsible for content synchronization and deployment. Due to a critical flaw in validating security headers, the application fails to properly verify incoming requests to the staging endpoint. This allows an unauthenticated attacker to bypass the initial authentication layer entirely.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a specially crafted HTTP POST request targeting the staging service endpoint (e.g., SyncServer.asmx). Because the security header validation is bypassed, the server processes the request as trusted. The payload contains serialized .NET object data controlled by the attacker. When the server attempts to deserialize this untrusted input, it triggers a .NET deserialization vulnerability (CWE-502), allowing the execution of arbitrary system commands under the context of the IIS application pool identity.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk. Successful exploitation grants the attacker complete control over the hosting server without requiring any prior credentials. This can lead to full infrastructure compromise, data exfiltration, ransomware deployment, and lateral movement within the internal network.

Official Vendor Advisories & References

NVD Original English Description

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

http://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://devnet.kentico.com/download/hotfixes#securityBugs-v12

Source: cve@mitre.org · Release Notes, Vendor Advisory

http://packetstormsecurity.com/files/157588/Kentico-CMS-12.0.14-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://devnet.kentico.com/download/hotfixes#securityBugs-v12

Source: af854a3a-2127-422b-91ae-364da2661108 · Release Notes, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10068

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2019-10068)

FAQ

Q1. How critical is CVE-2019-10068 and is it actively exploited in the wild?

CVE-2019-10068 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 95.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2019-10068?

Primary impacted vendors include kentico across kentico_cms. Scope summary: Kentico CMS 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions

Q3. What temporary mitigations or workarounds exist for CVE-2019-10068 before patching?

[Mitigation] Immediately apply the official vendor hotfixes or restrict external network access to the Kentico Staging Service endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION