CVE-2025-53690

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53690
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*
History

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690 -

05 Sep 2025, 13:48

Type Values Removed Values Added
First Time Sitecore managed Cloud
Sitecore
Sitecore experience Manager
Sitecore experience Commerce
Sitecore experience Platform
References () https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability - () https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability - Exploit, Third Party Advisory
References () https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 - () https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 - Vendor Advisory
CPE cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*

03 Sep 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-03 20:15

Updated : 2025-10-21 23:17

NVD link : CVE-2025-53690

Mitre link : CVE-2025-53690

CVE.ORG link : CVE-2025-53690

JSON object : View

Products Affected

sitecore

  • experience_commerce
  • experience_manager
  • experience_platform
  • managed_cloud
CWE
CWE-502

Deserialization of Untrusted Data