CVE-2019-10068: Kentico Xperience Deserialization of Untrusted Data Vulnerability

CVE-2019-10068 is a deserialization of untrusted data vulnerability in Kentico Xperience. According to CISA, the product fails to validate security headers, and this deserialization can lead to unauthenticated remote code execution. For IT and security teams running Kentico Xperience, the issue matters because an unauthenticated attacker who can reach the affected functionality may execute code on the server, potentially compromising the application and underlying host.

Public detail is limited to the facts above; exact affected builds, attack prerequisites, and patch identifiers must be confirmed against the vendor advisory. Known ransomware use is not documented for this CVE.

How it works

The weakness is CWE-502 (Deserialization of Untrusted Data). In this class of flaw, an application accepts serialized objects or related data from an untrusted source and reconstructs them without adequate validation. When security headers or other integrity checks are not properly enforced, an attacker can supply crafted input that the deserializer treats as legitimate.

Abuse typically involves sending specially formed requests that trigger the deserialization path. Because the CISA summary describes the outcome as unauthenticated remote code execution, a successful exploit can run attacker-chosen code in the context of the Kentico process without prior login. Specific payload formats, endpoints, or gadget chains are not provided in the available facts and should not be assumed; defenders must rely on the vendor advisory for precise mechanics.

Am I affected? How to find it in your systems

Kentico Xperience is a content management and digital experience platform commonly deployed as web applications on Windows servers or in hosting environments that support .NET workloads. Inventory any servers, virtual machines, containers, or cloud instances that host Kentico sites, including development, staging, and production.

• Identify installed Kentico Xperience instances through software inventory tools, package managers, IIS site bindings, configuration files, or administrative consoles.
• Compare the installed version and configuration against the list of affected releases in the vendor advisory; do not rely on version guesses.
• Review whether the instance is internet-facing or reachable from untrusted networks, as unauthenticated RCE increases exposure for externally accessible systems.
• Check application and web-server logs for anomalous requests that precede unusual process creation, unexpected outbound connections, or errors related to serialization or header validation. Telemetry signs of exploitation are not detailed in the public facts, so treat any unexplained code execution or new administrative activity on Kentico hosts as suspicious and investigate.

How to remediate

Patch first. Apply the updates provided by the vendor exactly as described in the Kentico advisory for CVE-2019-10068. CISA’s required action is to apply updates per vendor instructions.

• Schedule and test the vendor-supplied update in a non-production environment, then deploy to production promptly.
• After patching, verify the installed version matches the fixed release and confirm that previously vulnerable endpoints or features no longer accept the unsafe deserialization path.
• For this weakness class, harden by ensuring any remaining deserialization surfaces validate integrity (for example through proper security-header or signature checks), restrict the types that can be deserialized, and run the application pool or service under least privilege.
• Remove or disable unused Kentico modules and administrative interfaces that are not required.

If you can't patch immediately

Implement compensating controls to reduce risk until the vendor update can be applied.

• Segment Kentico hosts so they are not directly reachable from the internet or untrusted networks; place them behind reverse proxies or application gateways that can enforce strict allow-lists.
• Use a web application firewall or virtual patching rules tuned for deserialization and anomalous serialized payloads, while recognizing that signature-based controls are imperfect for this class.
• Disable or restrict any optional features or endpoints that perform deserialization if the vendor documentation permits it without breaking required business function.
• Increase monitoring: alert on new processes spawned by the Kentico worker processes, unexpected .NET runtime behavior, and authentication or configuration changes. Retain detailed web and application logs for forensic review.
• Enforce network egress filtering so a compromised host has limited ability to reach command-and-control or lateral targets.

If your data may have been exposed

Actively exploited vulnerabilities that yield remote code execution can lead to full system compromise and data theft. If you have evidence of exploitation or cannot rule it out, follow your incident-response process: isolate affected hosts, preserve logs and memory images, rotate credentials and secrets that the application could access, and assess what data the Kentico instance could reach. You can run a free exposure scan of your email addresses to check whether they appear in known breach data sets as one additional step in understanding potential impact.