1. Home
  2. Vulnerabilities
  3. CVE-2025-53690
Known Exploited Vulnerability
9.0
CRITICAL CVSS 3.1
CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability - [Actively Exploited]
Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

INFO

Published Date :

Sept. 3, 2025, 8:15 p.m.

Last Modified :

Sept. 5, 2025, 1:48 p.m.

Remotely Exploit :

Yes !

Source :

9947ef80-c5d5-474a-bbab-97341a59000e
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53690

Affected Products

The following products are affected by CVE-2025-53690 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Sitecore experience_platform
2 Sitecore experience_manager
3 Sitecore experience_commerce
4 Sitecore managed_cloud
: Total Affected Vendor : 1 | Products : 4
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 9947ef80-c5d5-474a-bbab-97341a59000e
CVSS 3.1 CRITICAL MITRE-CVE
Solution
Update Sitecore to a version that addresses the deserialization vulnerability.
  • Update Sitecore Experience Manager (XM) or Platform (XP).
  • Apply relevant security patches from Sitecore.
  • Validate the integrity of all deserialized data.
Public PoC/Exploit Available at Github

CVE-2025-53690 has a 8 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-53690.

URL Resource
https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Vendor Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-53690 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-53690 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
m0d0ri205/CVE-2025-53690-Analysis

This is CVE-2025-53690 Analysis Documents.

Updated: 3 weeks, 5 days ago
1 stars 0 fork 0 watcher
Born at : Sept. 7, 2025, 3:20 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
B1ack4sh/Blackash-CVE-2025-53690

CVE-2025-53690

Updated: 4 weeks, 1 day ago
0 stars 0 fork 0 watcher
Born at : Sept. 5, 2025, 2:47 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
rxerium/CVE-2025-53690

Detection for CVE-2025-53690

cisa kev sitecore zeroday cve-2025-53690

Updated: 3 weeks, 5 days ago
3 stars 1 fork 1 watcher
Born at : Sept. 4, 2025, 7:53 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
optimak/sacr_agent

None

Dockerfile Python

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2025, 2:55 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
DevGreick/devgreick

None

Python

Updated: 1 week, 3 days ago
1 stars 0 fork 0 watcher
Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 9 different CVEs too.
Profile Photo
rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 4 days, 2 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 25 different CVEs too.
Profile Photo
felipealfonsog/felipealfonsog

Journey through the cryptic corridors of code. Unravel the secrets encoded in the shadows. Welcome to the realm where algorithms whisper in binary tongues. Dare to explore, for within lies the essence of innovation.

computer-architecture computer-engineering computer-science data-engineering research-and-development research-software-engineering software-engineering

Python Nix

Updated: 3 days, 11 hours ago
1 stars 0 fork 0 watcher
Born at : Aug. 8, 2020, 8:50 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 week, 3 days ago
7289 stars 1207 fork 1207 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 821 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-53690 vulnerability anywhere in the article.

  • Huntress
Top Cyber Threat Trends of 2025 from Deepfakes, ClickFix, and ViewState Exploits

Cloudflare Turnstile challenges leading to MetaStealer. Deepfake meetings impersonating company executives, which trick employees into downloading malicious extensions. Exposed ASP.NET machine keys th ... Read more

Published Date: Oct 02, 2025 (3 days ago)
  • Daily CyberSecurity
Hidden Backdoors in WordPress: How Attackers Use Fake Plugins and Core Files for Persistent Access

Security researcher Puja Srivastava from Sucuri uncovered two malicious files designed to guarantee persistent attacker access by manipulating administrator accounts in a compromised WordPress website ... Read more

Published Date: Sep 25, 2025 (1 week, 3 days ago)
  • Daily CyberSecurity
New Phishing Campaign Targets PyPI Maintainers with Fake Domain

The Python Package Index (PyPI) is once again the target of a phishing campaign aimed at maintainers, with attackers using domain confusion tactics and convincing emails to steal credentials. Accordin ... Read more

Published Date: Sep 25, 2025 (1 week, 3 days ago)
  • Daily CyberSecurity
CVE-2025-41715 (CVSS 9.8): Unauthenticated Flaw Exposes WAGO Industrial Databases

VDE CERT has issued a security advisory disclosing two vulnerabilities in WAGO Device Sphere and WAGO Solution Builder, software widely used for industrial automation and device management. The flaws, ... Read more

Published Date: Sep 25, 2025 (1 week, 3 days ago)
  • Daily CyberSecurity
ShadowV2: How a New DDoS Botnet Mimics Cloud-Native Apps

The login UI | Image: Darktrace Researchers at Darktrace have identified a sophisticated new campaign that merges traditional malware techniques with modern DevOps practices. Dubbed ShadowV2, this ope ... Read more

Published Date: Sep 25, 2025 (1 week, 3 days ago)
  • Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto
Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation

Microsoft has addressed a critical security vulnerability in Azure Entra ID, tracked as CVE-2025-55241, that was initially described as a low-impact privilege escalation bug. Security research later ... Read more

Published Date: Sep 23, 2025 (1 week, 4 days ago)
  • Daily CyberSecurity
CVE-2025-9242: Critical WatchGuard Flaw Allows Remote Code Execution

WatchGuard has issued a security advisory addressing a critical vulnerability in its Fireware OS, tracked as CVE-2025-9242 with a CVSS v4 score of 9.3. The flaw resides in the iked process and could a ... Read more

Published Date: Sep 17, 2025 (2 weeks, 3 days ago)
  • Daily CyberSecurity
Kubernetes C# Client Flaw Exposes API to MITM Attacks (CVE-2025-9708)

A newly disclosed vulnerability in the Kubernetes C# client has been assigned CVE-2025-9708 with a CVSS score of 6.8 (Medium severity). The flaw stems from improper certificate validation in custom Ce ... Read more

Published Date: Sep 17, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
KSMBDrain (CVE-2025-38501): Linux Kernel Flaw Allows Remote DoS Attacks, PoC Available

A newly disclosed vulnerability in the Linux kernel’s KSMBD subsystem has been assigned CVE-2025-38501, allowing remote attackers to exhaust server resources and cause denial-of-service (DoS) conditio ... Read more

Published Date: Sep 17, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
AISURU Botnet: From Record-Breaking DDoS to Residential Proxy Empire

The AISURU botnet, first disclosed by XLab in 2024, has rapidly become one of the most dangerous forces in the DDoS landscape. In 2025 alone, it was linked to multiple record-breaking attacks, includi ... Read more

Published Date: Sep 17, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
Chrome’s New Preloading is a Game-Changer

Google has long experimented with prerendering technology in Chrome to accelerate page loading by rendering content in advance so that pages would open instantly upon a click. However, this approach o ... Read more

Published Date: Sep 16, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
China Accuses NVIDIA of Anti-Monopoly Violations

China’s State Administration for Market Regulation (SAMR) issued a statement today declaring that NVIDIA’s $6.9 billion acquisition of Mellanox in 2019 violated both the Anti-Monopoly Law of the Peopl ... Read more

Published Date: Sep 16, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
Apple Ends iCloud Support for Older Devices

According to Apple’s newly published support documentation, devices running iOS 10 or macOS 10.12 no longer meet the minimum system requirements for iCloud services. As a result, these systems will lo ... Read more

Published Date: Sep 16, 2025 (2 weeks, 4 days ago)
  • Daily CyberSecurity
CVE-2025-5821: Critical Authentication Bypass in WordPress Case Theme User Plugin Exploited in the Wild

Hackers are exploiting a critical authentication bypass vulnerability in the Case Theme User plugin, a WordPress plugin with an estimated 12,000 active installations. This plugin is bundled in multipl ... Read more

Published Date: Sep 16, 2025 (2 weeks, 5 days ago)
  • Daily CyberSecurity
PoC Published: Linux Kernel 0-Click RCE Vulnerability Found in ksmbd

Image: BitsByWill In a recent deep-dive analysis, security researcher BitsByWill examined two critical Linux kernel vulnerabilities—CVE-2023-52440 and CVE-2023-4130—both impacting ksmbd, the in-kernel ... Read more

Published Date: Sep 16, 2025 (2 weeks, 5 days ago)
  • Daily CyberSecurity
OpenAI’s New Grove Incubator Is Building the Next Generation of AI Startups

OpenAI recently unveiled its internal incubation initiative, OpenAI Grove. Unlike traditional startup accelerators or incubator programs, Grove emphasizes engaging with potential founders before their ... Read more

Published Date: Sep 15, 2025 (2 weeks, 5 days ago)
  • Daily CyberSecurity
Samsung Zero-Day Exploit CVE-2025-21043 Patched After Active Attacks on Android Devices

Samsung has released security updates to patch a critical zero-day vulnerability actively exploited against Android devices. Tracked as CVE-2025-21043 with a CVSS score of 8.8, the flaw enables remote ... Read more

Published Date: Sep 15, 2025 (2 weeks, 5 days ago)
  • Daily CyberSecurity
PoC Available: FlowiseAI Flaw (CVE-2025-58434) Allows Full Account Takeover (CVSS 9.8)

The open-source generative AI development platform FlowiseAI, widely used for building AI agents and LLM workflows, has been found vulnerable to a critical flaw that enables unauthenticated account ta ... Read more

Published Date: Sep 15, 2025 (2 weeks, 6 days ago)
  • Daily CyberSecurity
Digiever NVR Flaws (CVE-2025-10264, CVE-2025-10265) Let Hackers Steal Credentials & Take Control

The Taiwan Computer Emergency Response Team (TWCERT/CC) has issued a vulnerability note warning of two critical security flaws in Digiever’s Network Video Recorder (NVR) product line. Tracked as CVE-2 ... Read more

Published Date: Sep 15, 2025 (2 weeks, 6 days ago)
  • Daily CyberSecurity
CVE-2025-9556 (CVSS 9.8):Critical Vulnerability in LangChainGo Puts LLM Apps at Risk

The rise of large language model (LLM) applications has made frameworks like LangChain and its ports foundational for developers worldwide. But according to a recent CERT/CC Vulnerability Note, a crit ... Read more

Published Date: Sep 15, 2025 (2 weeks, 6 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-53690 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Sep. 05, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:* *cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:* versions up to (including) 9.0 *cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:* versions up to (including) 9.0 *cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:* versions up to (including) 9.0
    Added Reference Type Wiz: https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Types: Exploit, Third Party Advisory
    Added Reference Type Wiz: https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Types: Vendor Advisory
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 05, 2025

    Action Type Old Value New Value
    Added Date Added 2025-09-04
    Added Due Date 2025-09-25
    Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    Added Vulnerability Name Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
  • New CVE Received by 9947ef80-c5d5-474a-bbab-97341a59000e

    Sep. 03, 2025

    Action Type Old Value New Value
    Added Description Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
    Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-502
    Added Reference https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability
    Added Reference https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.0
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact