CVE-2025-53690

Published Sep 3, 2025

Last updated 3 months ago

Exploit known CVSS critical 9.0

Sitecore XM

Sitecore XP

Sitecore

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53690 is a ViewState deserialization vulnerability affecting Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud. The vulnerability stems from the reuse of a sample ASP.NET machine key that was included in official Sitecore deployment guides prior to 2017 and, in some instances, mistakenly implemented in production environments. Attackers who possess this key can create malicious __VIEWSTATE payloads, bypassing validation and enabling code execution on the targeted server. This turns a misconfiguration into a Remote Code Execution (RCE) vector. The initial compromise can grant attackers access under the NETWORK SERVICE account. The WEEPSTEEL malware may be deployed to gather system, network, and user information.

Description: Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Source: 9947ef80-c5d5-474a-bbab-97341a59000e
NVD status: Analyzed
Products: experience_commerce, experience_manager, experience_platform, managed_cloud

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Exploit added on: Sep 4, 2025
Exploit action due: Sep 25, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

9947ef80-c5d5-474a-bbab-97341a59000e: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40097CA2-94C2-4CBD-B94C-10B5A8F282FD",
            "versionEndIncluding": "9.0"
          },
          {
            "criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "96C832B3-FB9D-443A-A501-65BFF0A47092",
            "versionEndIncluding": "9.0"
          },
          {
            "criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8F60EDF8-6CCE-4440-A4FB-337FBFC881DD",
            "versionEndIncluding": "9.0"
          },
          {
            "criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.