CVE-2025-53690
Sitecore Multiple Products
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
What it is
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
- nvd.nist.gov/vuln/detail/CVE-2025-53690
Description and required action as published by CISA. Full record at NVD.
Other Sitecore entries on the list
- CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability CVE-2019-9875 · Mar 26, 2025
- CMS and Experience Platform (XP) Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability CVE-2019-9874 · Mar 26, 2025
- XP Sitecore XP Remote Command Execution Vulnerability CVE-2021-42237 · Mar 25, 2022