ACTIEF MISBRUIKT
CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
| Leverancier | Sitecore |
|---|---|
| Product | Multiple Products |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 4 sep 2025 |
| CISA-deadline (Amerikaanse overheid) | 25 sep 2025 |
| Zwakte (CWE) | CWE-502 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
BRONNEN
Andere lekken bij Sitecore
- CVE-2019-9875: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2021-42237: Sitecore XP Remote Command Execution Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.