Description
An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Kentico CMS Staging SyncServer Unserialize Remote Command Execution
exploit/windows/http/kentico_staging_syncserver
GitHub 1 repository
-
crukz404/CVE-2019-10068-PoC ★ 0 · Mar 11, 2026
Proof of concept exploit for CVE-2019-10068.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Kentico CMS Insecure Deserialization Remote Code Execution http/cves/2019/CVE-2019-10068.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.