CVE DatabaseCVE-2025-53690

Updated 2026-10-18한국어 권고문 →

CVE-2025-536909.0/CRITICALCISA KEVCWE-502

Sitecore Experience Manager and Experience Platform Remote Code Execution Vulnerability (CVE-2025-53690) Security Advisory

⚡ Jump to Patch

Affected Vendors

sitecore

Affected Components

experience manager, experience platform

Published Date

2025-09-03

CVSS v3.1

9.0

CRITICAL

EPSS (30d)

60.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Sitecore Experience Manager (XM) and Experience Platform (XP) versions up to and including 9.0

Impact

Unauthenticated remote attackers can execute arbitrary code and fully compromise the host system via deserialization of untrusted data

Mitigation

Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access

Affected Products & Version Scope

Sitecore Experience Manager (XM) through 9.0 and Sitecore Experience Platform (XP) through 9.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to the official Sitecore security advisory (KB1003865) to apply the appropriate hotfix or upgrade to a supported secure version. Use the following PowerShell command to verify the installed version of the Sitecore kernel assembly:

powershell

# Check the version of Sitecore.Kernel.dll to identify vulnerable instances
Get-ChildItem -Path 'C:\inetpub\wwwroot\*\bin\Sitecore.Kernel.dll' | Select-Object VersionInfo

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, enforce ViewState encryption and validation within the IIS web.config file to mitigate potential exploitation vectors.

xml

<!-- Enforce ViewState encryption and secure machineKey configuration in web.config -->
<configuration>
  <system.web>
    <pages viewStateEncryptionMode='Always' />
    <machineKey validation='SHA1' validationKey='AutoGenerate,IsolateApps' decryption='AES' decryptionKey='AutoGenerate,IsolateApps' />
  </system.web>
</configuration>

3. Log Audit & IoC Verification Commands

Run the following PowerShell script to inspect IIS access logs for suspicious POST requests targeting administrative endpoints or containing potential deserialization payloads.

powershell

# Search IIS logs for suspicious patterns related to ViewState manipulation or admin endpoint access
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
Select-String -Path $LogPath -Pattern '(?i)(__VIEWSTATE|__EVENTVALIDATION|/sitecore/admin/)' | Select-Object -First 50

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the vendor-provided security patches or implement the recommended workarounds.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-53690) is a deserialization of untrusted data vulnerability (CWE-502) residing in legacy architectures of Sitecore Experience Manager (XM) and Experience Platform (XP). It occurs when the application processes user-supplied serialized data (such as ASP.NET ViewState or internal serialization endpoints) without proper signature validation or encryption. This allows attackers to inject malicious serialized objects that trigger arbitrary code execution during the deserialization process.

2. Exploitation Mechanics & Attack Scenario

An attacker can craft a malicious payload using .NET deserialization gadget chains (e.g., via tools like ysoserial.net) and send it to the vulnerable Sitecore endpoints or via manipulated ViewState parameters. When the server deserializes this untrusted input, the payload executes arbitrary system commands under the security context of the IIS worker process (w3wp.exe). This vulnerability has been observed in active zero-day exploitation campaigns.

3. Infrastructure & Business Impact

With a CVSS score of 9.0 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants the attacker full control over the web server, enabling lateral movement within the internal network, database exfiltration, ransomware deployment, and complete business disruption.

Official Vendor Advisories & References

NVD Original English Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability

Source: 9947ef80-c5d5-474a-bbab-97341a59000e · Exploit, Third Party Advisory

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865

Source: 9947ef80-c5d5-474a-bbab-97341a59000e · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-53690)

FAQ

Q1. How critical is CVE-2025-53690 and is it actively exploited in the wild?

CVE-2025-53690 is rated CVSS 9.0 (CRITICAL) with a 30-day EPSS exploitation probability of 60.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-53690?

Primary impacted vendors include sitecore across experience manager, experience platform. Scope summary: Sitecore Experience Manager (XM) through 9.0 and Sitecore Experience Platform (XP) through 9.0

Q3. What temporary mitigations or workarounds exist for CVE-2025-53690 before patching?

[Mitigation] Immediately apply the official security patches from the vendor, or implement temporary workarounds such as enforcing ViewState encryption and restricting access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION