CVE-2025-53690: Sitecore Multiple Products deserialization of untrusted data

CVE-2025-53690 · Severity: critical · CVSS 9 · Exploited in the wild · Published 2025-09-04

Sitecore Experience Manager and related products, which are used by organizations to manage digital content and customer experiences, contain a critical security flaw. This vulnerability allows an attacker to take full control of the server by exploiting default security keys used to protect web session data. This issue has been observed being used in active attacks, potentially leading to data theft or complete service disruption.

Technologies: Apple Multiple Products. Vendors: Apple, Sitecore.

Quick answers

Is CVE-2025-53690 exploited in the wild?
Yes. CVE-2025-53690 is known to be exploited in the wild, first recorded on 4 September 2025. Treat it as urgent.
How severe is CVE-2025-53690?
Critical severity, with a CVSS score of 9, published 4 September 2025.
Which products and versions are affected?
Sitecore Experience Commerce through 9.0; Sitecore Experience Manager through 9.0; Sitecore Experience Platform through 9.0; Sitecore Managed Cloud All versions.
Is there a fix for CVE-2025-53690?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-53690 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-53690?
Check whether you run Apple Multiple Products, Sitecore Experience Commerce, Sitecore Experience Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in multiple Sitecore products due to the use of default ASP.NET machine keys. An unauthenticated attacker can leverage these known keys to craft malicious ViewState payloads. When the server attempts to deserialize this untrusted data, it results in remote code execution (RCE) with the privileges of the web application. The vulnerability is particularly severe as it has been exploited in the wild as a zero-day. Organizations are advised to rotate their machine keys and apply vendor-provided mitigations immediately.

Affected products

  • Sitecore Experience Manager (XM) through 9.0
  • Sitecore Experience Platform (XP) through 9.0
  • Sitecore Experience Commerce (XC) through 9.0
  • Sitecore Managed Cloud All versions

Timeline

  • 2025-09-03: disclosed: Initial disclosure by Wiz and Sitecore
  • 2025-09-04: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-09-04: advisory: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.