What’s Vulnerable › Products

Sitecore Experience Commerce vulnerabilities

10 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Sitecore Experience Commerce version is affected

Exploited Sitecore Experience Commerce vulnerabilities

• CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Latest Sitecore Experience Commerce vulnerabilities

• CVE-2025-53690 — Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability (CVSS 9.0) — exploited
• CVE-2025-53694 — Information Disclosure in ItemServices API (CVSS 7.5)
• CVE-2025-53693 — HTML Cache Poisoning through Unsafe Reflections (CVSS 9.8)
• CVE-2025-53691 — Sitecore Experience Remote Code Execution through Insecure Deserialization (CVSS 8.8)
• CVE-2025-34511 — Sitecore PowerShell Extension RCE via Unrestricted Upload (CVSS 8.8)
• CVE-2025-34510 — Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip (CVSS 8.8)
• CVE-2025-34509 — Sitecore XM and XP Hardcoded Credentials (CVSS 7.5)
• CVE-2024-46938 — (CVSS 7.5)
• CVE-2023-35813 — (CVSS 9.8)
• CVE-2023-33651 — (CVSS 7.5)