CVE-2025-53690
Critical 9.0 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Metrics
- CVSS 3.1
-
9.0 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 61% (percentile: 99) as of 1 November 2026
- CWE
- CWE-502
Affected products
sitecore: experience commerce; sitecore: experience manager; sitecore: experience platform; sitecore: managed cloud
References
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Vendor Advisory
- https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserializat… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource