insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)

Summary

This critical vulnerability involves an insecure deserialization issue in Sitecore implementation on ██████████ , which has been assigned CVE-2025-27218. The vulnerability allows remote code execution (RCE) through unsanitized user input in the ThumbnailsAccessToken header. Using the BinaryFormatter serialization method, an attacker can create malicious serialized objects with tools like ysoserial.net and execute arbitrary operating system commands on the target server. This poses a severe security risk as it allows complete system compromise, where attackers can create, read, and exfiltrate files, potentially gaining full control of the affected system. The vulnerability has been remediated by removing public access to the affected site, which is now protected behind Cloudflare WAF.