CVE-2025-53690
9.0 critical
KEV · due 2025-09-25
exploit ×3
SSVC exploitation: active
Analyzed
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Fix
Public exploits 3
- ErikLearningSec/CVE-2025-53690-POC PoC on GitHub
- m0d0ri205/CVE-2025-53690-Analysis PoC on GitHub
- rxerium/CVE-2025-53690 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2025-09-25
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added to the catalog 2025-09-04. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.0 · in KEV · sitecoreNVD modified 2026-10-18 21:10
Affected (CPE criteria) 4
cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*
References 3
- https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Exploit, Third Party Advisory
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690 US Government Resource