CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
INFO
Published Date :
Sept. 3, 2025, 8:15 p.m.
Last Modified :
Sept. 5, 2025, 1:48 p.m.
Remotely Exploit :
Yes !
Source :
9947ef80-c5d5-474a-bbab-97341a59000e
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53690
Affected Products
The following products are affected by CVE-2025-53690
vulnerability.
Even if cvefeed.io
is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
---|---|---|---|---|---|---|
CVSS 3.1 | CRITICAL | 9947ef80-c5d5-474a-bbab-97341a59000e | ||||
CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update Sitecore Experience Manager (XM) or Platform (XP).
- Apply relevant security patches from Sitecore.
- Validate the integrity of all deserialized data.
Public PoC/Exploit Available at Github
CVE-2025-53690 has a 8 public
PoC/Exploit
available at Github.
Go to the Public Exploits
tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-53690
.
URL | Resource |
---|---|
https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability | Exploit Third Party Advisory |
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-53690
is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-53690
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
This is CVE-2025-53690 Analysis Documents.
CVE-2025-53690
Detection for CVE-2025-53690
cisa kev sitecore zeroday cve-2025-53690
None
Dockerfile Python
None
Python
A list of all of my starred repos, automated using Github Actions 🌟
github-actions stars
Journey through the cryptic corridors of code. Unravel the secrets encoded in the shadows. Welcome to the realm where algorithms whisper in binary tongues. Dare to explore, for within lies the essence of innovation.
computer-architecture computer-engineering computer-science data-engineering research-and-development research-software-engineering software-engineering
Python Nix
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-53690
vulnerability anywhere in the article.

-
Huntress
Top Cyber Threat Trends of 2025 from Deepfakes, ClickFix, and ViewState Exploits
Cloudflare Turnstile challenges leading to MetaStealer. Deepfake meetings impersonating company executives, which trick employees into downloading malicious extensions. Exposed ASP.NET machine keys th ... Read more

-
Daily CyberSecurity
Hidden Backdoors in WordPress: How Attackers Use Fake Plugins and Core Files for Persistent Access
Security researcher Puja Srivastava from Sucuri uncovered two malicious files designed to guarantee persistent attacker access by manipulating administrator accounts in a compromised WordPress website ... Read more

-
Daily CyberSecurity
New Phishing Campaign Targets PyPI Maintainers with Fake Domain
The Python Package Index (PyPI) is once again the target of a phishing campaign aimed at maintainers, with attackers using domain confusion tactics and convincing emails to steal credentials. Accordin ... Read more

-
Daily CyberSecurity
CVE-2025-41715 (CVSS 9.8): Unauthenticated Flaw Exposes WAGO Industrial Databases
VDE CERT has issued a security advisory disclosing two vulnerabilities in WAGO Device Sphere and WAGO Solution Builder, software widely used for industrial automation and device management. The flaws, ... Read more

-
Daily CyberSecurity
ShadowV2: How a New DDoS Botnet Mimics Cloud-Native Apps
The login UI | Image: Darktrace Researchers at Darktrace have identified a sophisticated new campaign that merges traditional malware techniques with modern DevOps practices. Dubbed ShadowV2, this ope ... Read more

-
Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation
Microsoft has addressed a critical security vulnerability in Azure Entra ID, tracked as CVE-2025-55241, that was initially described as a low-impact privilege escalation bug. Security research later ... Read more

-
Daily CyberSecurity
CVE-2025-9242: Critical WatchGuard Flaw Allows Remote Code Execution
WatchGuard has issued a security advisory addressing a critical vulnerability in its Fireware OS, tracked as CVE-2025-9242 with a CVSS v4 score of 9.3. The flaw resides in the iked process and could a ... Read more

-
Daily CyberSecurity
Kubernetes C# Client Flaw Exposes API to MITM Attacks (CVE-2025-9708)
A newly disclosed vulnerability in the Kubernetes C# client has been assigned CVE-2025-9708 with a CVSS score of 6.8 (Medium severity). The flaw stems from improper certificate validation in custom Ce ... Read more

-
Daily CyberSecurity
KSMBDrain (CVE-2025-38501): Linux Kernel Flaw Allows Remote DoS Attacks, PoC Available
A newly disclosed vulnerability in the Linux kernel’s KSMBD subsystem has been assigned CVE-2025-38501, allowing remote attackers to exhaust server resources and cause denial-of-service (DoS) conditio ... Read more

-
Daily CyberSecurity
AISURU Botnet: From Record-Breaking DDoS to Residential Proxy Empire
The AISURU botnet, first disclosed by XLab in 2024, has rapidly become one of the most dangerous forces in the DDoS landscape. In 2025 alone, it was linked to multiple record-breaking attacks, includi ... Read more

-
Daily CyberSecurity
Chrome’s New Preloading is a Game-Changer
Google has long experimented with prerendering technology in Chrome to accelerate page loading by rendering content in advance so that pages would open instantly upon a click. However, this approach o ... Read more

-
Daily CyberSecurity
China Accuses NVIDIA of Anti-Monopoly Violations
China’s State Administration for Market Regulation (SAMR) issued a statement today declaring that NVIDIA’s $6.9 billion acquisition of Mellanox in 2019 violated both the Anti-Monopoly Law of the Peopl ... Read more

-
Daily CyberSecurity
Apple Ends iCloud Support for Older Devices
According to Apple’s newly published support documentation, devices running iOS 10 or macOS 10.12 no longer meet the minimum system requirements for iCloud services. As a result, these systems will lo ... Read more

-
Daily CyberSecurity
CVE-2025-5821: Critical Authentication Bypass in WordPress Case Theme User Plugin Exploited in the Wild
Hackers are exploiting a critical authentication bypass vulnerability in the Case Theme User plugin, a WordPress plugin with an estimated 12,000 active installations. This plugin is bundled in multipl ... Read more

-
Daily CyberSecurity
PoC Published: Linux Kernel 0-Click RCE Vulnerability Found in ksmbd
Image: BitsByWill In a recent deep-dive analysis, security researcher BitsByWill examined two critical Linux kernel vulnerabilities—CVE-2023-52440 and CVE-2023-4130—both impacting ksmbd, the in-kernel ... Read more

-
Daily CyberSecurity
OpenAI’s New Grove Incubator Is Building the Next Generation of AI Startups
OpenAI recently unveiled its internal incubation initiative, OpenAI Grove. Unlike traditional startup accelerators or incubator programs, Grove emphasizes engaging with potential founders before their ... Read more

-
Daily CyberSecurity
Samsung Zero-Day Exploit CVE-2025-21043 Patched After Active Attacks on Android Devices
Samsung has released security updates to patch a critical zero-day vulnerability actively exploited against Android devices. Tracked as CVE-2025-21043 with a CVSS score of 8.8, the flaw enables remote ... Read more

-
Daily CyberSecurity
PoC Available: FlowiseAI Flaw (CVE-2025-58434) Allows Full Account Takeover (CVSS 9.8)
The open-source generative AI development platform FlowiseAI, widely used for building AI agents and LLM workflows, has been found vulnerable to a critical flaw that enables unauthenticated account ta ... Read more

-
Daily CyberSecurity
Digiever NVR Flaws (CVE-2025-10264, CVE-2025-10265) Let Hackers Steal Credentials & Take Control
The Taiwan Computer Emergency Response Team (TWCERT/CC) has issued a vulnerability note warning of two critical security flaws in Digiever’s Network Video Recorder (NVR) product line. Tracked as CVE-2 ... Read more

-
Daily CyberSecurity
CVE-2025-9556 (CVSS 9.8):Critical Vulnerability in LangChainGo Puts LLM Apps at Risk
The rise of large language model (LLM) applications has made frameworks like LangChain and its ports foundational for developers worldwide. But according to a recent CERT/CC Vulnerability Note, a crit ... Read more
The following table lists the changes that have been made to the
CVE-2025-53690
vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Sep. 05, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:* *cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:* versions up to (including) 9.0 *cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:* versions up to (including) 9.0 *cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:* versions up to (including) 9.0 Added Reference Type Wiz: https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Types: Exploit, Third Party Advisory Added Reference Type Wiz: https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Types: Vendor Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Sep. 05, 2025
Action Type Old Value New Value Added Date Added 2025-09-04 Added Due Date 2025-09-25 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability -
New CVE Received by 9947ef80-c5d5-474a-bbab-97341a59000e
Sep. 03, 2025
Action Type Old Value New Value Added Description Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-502 Added Reference https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Added Reference https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865