PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-10068 Kentico CVE debrief

CVE-2019-10068 is a Kentico Xperience deserialization of untrusted data issue that CISA added to the Known Exploited Vulnerabilities catalog on 2022-03-25. Because it is KEV-listed, defenders should treat it as actively risky and prioritize Kentico's update guidance immediately, with the supplied due date of 2022-04-15 as the urgency benchmark.

Vendor
Kentico
Product
Xperience
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-25
Original CVE updated
2022-03-25
Advisory published
2022-03-25
Advisory updated
2022-03-25

Who should care

Organizations running Kentico Xperience, especially teams responsible for internet-facing web applications, CMS administration, patching, and security monitoring, should prioritize this issue.

Technical summary

The supplied corpus identifies this as a deserialization of untrusted data vulnerability in Kentico Xperience. In general, unsafe deserialization can let an application process attacker-influenced serialized input without adequate trust controls, which may lead to application compromise. The confirmed facts in the supplied sources are the product, the vulnerability class, and the CISA KEV listing; no CVSS score was provided.

Defensive priority

High. A CISA KEV listing indicates known exploitation risk, so this should be remediated urgently using vendor instructions.

Recommended defensive actions

  • Apply Kentico's vendor-provided updates and remediation guidance as soon as possible.
  • Inventory all Kentico Xperience deployments and confirm which instances are exposed or production-critical.
  • Prioritize remediation for any internet-facing or externally reachable systems first.
  • Validate that patched systems are running the expected fixed version after maintenance.
  • Review relevant logs and alerts for suspicious activity around affected systems while remediation is in progress.

Evidence notes

Evidence is limited to the supplied CISA KEV feed metadata and the official reference links. The corpus confirms the vendor/project pairing (Kentico / Xperience), the vulnerability name, the KEV dateAdded of 2022-03-25, the dueDate of 2022-04-15, and the required action 'Apply updates per vendor instructions.' No CVSS score or deeper technical analysis was supplied in the corpus.

Official resources

Publicly listed by CISA in the Known Exploited Vulnerabilities catalog on 2022-03-25. The supplied corpus does not include the original vendor disclosure timeline.