CVE-█████-35813 in █████

Summary

A security researcher discovered a critical remote code execution vulnerability (CVE-██████-35813) affecting multiple Sitecore products through version 10.3. The vulnerability was exploited through the sitecore_xaml.ashx endpoint using ASP.NET TemplateParser injection, allowing attackers to execute arbitrary code by manipulating the ParseControl function with malicious XAML markup. Initial testing demonstrated successful code execution with a CVSS score of 9.8. The organization successfully applied the Sitecore security patch, and subsequent retesting confirmed the vulnerability was fully remediated. We appreciate the thorough documentation and responsible disclosure of this critical security issue.