Research · Sep 3, 2025 · ZeroDay Catalog
Critical Deserialization Vulnerability Found in Sitecore Products
A serious deserialization vulnerability has been identified in multiple Sitecore products, potentially allowing remote code execution through exposed machine keys.
What changed
A significant vulnerability has been discovered in Sitecore's suite of products, specifically related to the deserialization of untrusted data. This flaw arises from the use of default ASP.NET machine keys, which can be exploited by attackers to execute arbitrary code remotely.
Who is affected
Organizations utilizing Sitecore's products are at risk due to this vulnerability. The affected products include:
- Sitecore Experience Manager (XM)
- Sitecore Experience Platform (XP)
- Sitecore Experience Commerce (XC)
- Sitecore Managed Cloud
What to do
It is crucial for security operators to assess their Sitecore implementations and take immediate action to mitigate this vulnerability. Recommendations include reviewing machine key configurations and applying necessary updates.
- Change default machine keys to custom values.
- Monitor for any unusual activity that may indicate exploitation attempts.
- Stay informed on updates from Sitecore regarding patches or further guidance.