ZeroDay Findings
Sign inSign up

Findings

CVE-2025-53690

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Published Sep 3, 2025 · updated Jun 17, 2026 · sitecore experience commerce

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 3, 2025 · Catalog

    Detected

    Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

  2. Sep 4, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Sep 25, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Sep 25, 2025

Affected

  • cpe sitecore/experience commerceversion unspecified
  • cpe sitecore/experience managerversion unspecified
  • cpe sitecore/experience platformversion unspecified
  • cpe sitecore/managed cloudversion unspecified
  • vendor Sitecore Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2025-53690

    Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

    cisa.gov
  • CVE.orgCVE-2025-53690

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-53690

    30-day exploitation probability 60.6%

    first.org
  • NIST NVDCVE-2025-53690

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

    nvd.nist.gov

References