CVE-2025-53690

9.0

CRITICAL CVSS 3.1

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability - [Actively Exploited]

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

INFO

Published Date :

Sept. 3, 2025, 8:15 p.m.

Last Modified :

Oct. 21, 2025, 11:17 p.m.

Remotely Exploit :

Yes !

Source :

9947ef80-c5d5-474a-bbab-97341a59000e

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Sep 25, 2025

Alert Date: Sep 04, 2025 | 55 days ago

Description :

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53690

Affected Products

The following products are affected by CVE-2025-53690 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Sitecore	experience_platform
2	Sitecore	experience_manager
3	Sitecore	experience_commerce
4	Sitecore	managed_cloud

: Total Affected Vendor : 1 | Products : 4

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				9947ef80-c5d5-474a-bbab-97341a59000e
	CVSS 3.1	CRITICAL				MITRE-CVE

Solution

Update Sitecore to a version that addresses the deserialization vulnerability.

Update Sitecore Experience Manager (XM) or Platform (XP).
Apply relevant security patches from Sitecore.
Validate the integrity of all deserialized data.

Public PoC/Exploit Available at Github

CVE-2025-53690 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-53690.

URL	Resource
https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability	Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-53690 is associated with the following CWEs:

CWE-502: Deserialization of Untrusted Data

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-53690 weaknesses.

CAPEC-586: Object Injection Object Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

m0d0ri205/CVE-2025-53690-Analysis

This is CVE-2025-53690 Analysis Documents.

Updated: 1 month, 2 weeks ago

1 stars 0 fork 0 watcher

Born at : Sept. 7, 2025, 3:20 a.m. This repo has been linked 1 different CVEs too.

B1ack4sh/Blackash-CVE-2025-53690

CVE-2025-53690

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 5, 2025, 2:47 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-53690

Detection for CVE-2025-53690

cisa kev sitecore zeroday cve-2025-53690

Updated: 2 weeks ago

4 stars 1 fork 1 watcher

Born at : Sept. 4, 2025, 7:53 p.m. This repo has been linked 1 different CVEs too.

optimak/sacr_agent

None

Dockerfile Python

Updated: 1 month, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Sept. 4, 2025, 2:55 a.m. This repo has been linked 1 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 4 weeks ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 25 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 3 days, 17 hours ago

7345 stars 1210 fork 1210 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 837 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-53690 vulnerability anywhere in the article.

Daily CyberSecurity

CVE-2025-55315: Critical 9.9/10 Flaw in ASP.NET Core Enables Unauthenticated Attack

Microsoft has confirmed the remediation of a critical security vulnerability in its ASP.NET Core product, identified as CVE-2025-55315, with an exceptionally high severity score of 9.9 out of 10. The ...

Published Date: Oct 21, 2025 (1 week, 1 day ago)

Google Cloud

Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign

Written by: Peter Ukhanov, Genevieve Stark, Zander Work, Ashley Pearson, Josh Murchie, Austin Larsen Introduction Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began t ...

Published Date: Oct 09, 2025 (2 weeks, 5 days ago)

Huntress

Top Cyber Threat Trends of 2025 from Deepfakes, ClickFix, and ViewState Exploits

Cloudflare Turnstile challenges leading to MetaStealer. Deepfake meetings impersonating company executives, which trick employees into downloading malicious extensions. Exposed ASP.NET machine keys th ...

Published Date: Oct 02, 2025 (3 weeks, 6 days ago)

Daily CyberSecurity

Hidden Backdoors in WordPress: How Attackers Use Fake Plugins and Core Files for Persistent Access

Security researcher Puja Srivastava from Sucuri uncovered two malicious files designed to guarantee persistent attacker access by manipulating administrator accounts in a compromised WordPress website ...

Published Date: Sep 25, 2025 (1 month ago)

Daily CyberSecurity

New Phishing Campaign Targets PyPI Maintainers with Fake Domain

The Python Package Index (PyPI) is once again the target of a phishing campaign aimed at maintainers, with attackers using domain confusion tactics and convincing emails to steal credentials. Accordin ...

Published Date: Sep 25, 2025 (1 month ago)

Daily CyberSecurity

CVE-2025-41715 (CVSS 9.8): Unauthenticated Flaw Exposes WAGO Industrial Databases

VDE CERT has issued a security advisory disclosing two vulnerabilities in WAGO Device Sphere and WAGO Solution Builder, software widely used for industrial automation and device management. The flaws, ...

Published Date: Sep 25, 2025 (1 month ago)

Daily CyberSecurity

ShadowV2: How a New DDoS Botnet Mimics Cloud-Native Apps

The login UI | Image: Darktrace Researchers at Darktrace have identified a sophisticated new campaign that merges traditional malware techniques with modern DevOps practices. Dubbed ShadowV2, this ope ...

Published Date: Sep 25, 2025 (1 month ago)

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto

Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation

Microsoft has addressed a critical security vulnerability in Azure Entra ID, tracked as CVE-2025-55241, that was initially described as a low-impact privilege escalation bug. Security research later ...

Published Date: Sep 23, 2025 (1 month ago)

Daily CyberSecurity

CVE-2025-9242: Critical WatchGuard Flaw Allows Remote Code Execution

WatchGuard has issued a security advisory addressing a critical vulnerability in its Fireware OS, tracked as CVE-2025-9242 with a CVSS v4 score of 9.3. The flaw resides in the iked process and could a ...

Published Date: Sep 17, 2025 (1 month, 1 week ago)

Daily CyberSecurity

Kubernetes C# Client Flaw Exposes API to MITM Attacks (CVE-2025-9708)

A newly disclosed vulnerability in the Kubernetes C# client has been assigned CVE-2025-9708 with a CVSS score of 6.8 (Medium severity). The flaw stems from improper certificate validation in custom Ce ...

Published Date: Sep 17, 2025 (1 month, 1 week ago)

Daily CyberSecurity

KSMBDrain (CVE-2025-38501): Linux Kernel Flaw Allows Remote DoS Attacks, PoC Available

A newly disclosed vulnerability in the Linux kernel’s KSMBD subsystem has been assigned CVE-2025-38501, allowing remote attackers to exhaust server resources and cause denial-of-service (DoS) conditio ...

Published Date: Sep 17, 2025 (1 month, 1 week ago)

Daily CyberSecurity

AISURU Botnet: From Record-Breaking DDoS to Residential Proxy Empire

The AISURU botnet, first disclosed by XLab in 2024, has rapidly become one of the most dangerous forces in the DDoS landscape. In 2025 alone, it was linked to multiple record-breaking attacks, includi ...

Published Date: Sep 17, 2025 (1 month, 1 week ago)

Daily CyberSecurity

Chrome’s New Preloading is a Game-Changer

Google has long experimented with prerendering technology in Chrome to accelerate page loading by rendering content in advance so that pages would open instantly upon a click. However, this approach o ...