What’s Vulnerable › Vulnerabilities

CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-09-04
• EPSS: 60.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-03 · updated 2026-10-18
• Weakness: CWE-502

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Affected products

• Sitecore Experience Commerce: through 9.0
• Sitecore Experience Manager: through 9.0
• Sitecore Experience Platform: through 9.0
• Sitecore Managed Cloud: all versions

References

• https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690

Get alerted when CVE-2025-53690 or the next vulnerability affects your stack