CVE-2025-53690criticalunder attackCWE-502

CVE-2025-53690: critical vulnerability in Sitecore Experience Manager (XM)

Sitecore Products ViewState Deserialization Vulnerability

Published · Updated

Follow this CVE+ Monitor Experience Platform+ Monitor Experience Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9epss 61%
from disclosure to weapon1 day
Published on NVDSep 3
1st PoC+1d
CISA KEV+1d
Action required by CISAfederal deadline: 2025-09-25

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Sitecore products improperly deserialize untrusted data in ViewState, allowing attackers to inject and execute arbitrary code on the server. This affects Sitecore Experience Manager and Experience Platform versions up to 9.0.

Technical detail

A deserialization vulnerability in ViewState handling permits code injection via untrusted data. Attackers can craft malicious serialized objects that execute arbitrary code when deserialized by the application, affecting Sitecore XM and XP up to version 9.0 with no authentication requirement for exploitation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Sitecore · Experience Manager (XM)Sitecore · Experience Platform (XP)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sitecore Experience Manager (XM)

In the same product, most dangerous first.

CVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2025-53694HIGHInformation Disclosure in ItemServices APIEPSS 6.9%CVE-2025-53691HIGHSitecore Experience Remote Code Execution through Insecure DeserializationEPSS 1.6%CVE-2015-10142MEDIUMSitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathEPSS 0.6%CVE-2025-34139HIGHSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File ReadEPSS 0.5%CVE-2025-53692HIGHSitecore Experience Platform Cross-Site Scripting VulnerabilityEPSS 0.4%