ACTIVELY EXPLOITED
CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
| Vendor | Sitecore |
|---|---|
| Product | Multiple Products |
| Actively exploited | Yes |
| Added to CISA KEV | 4 Sep 2025 |
| CISA federal deadline | 25 Sep 2025 |
| Weakness (CWE) | CWE-502 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
SOURCES
Other Sitecore flaws
- CVE-2019-9875: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2021-42237: Sitecore XP Remote Command Execution Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.