CVE-2025-53690
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
CISA Known Exploited Vulnerability
Vendor / Product
Sitecore — Multiple Products
Date Added
2025-09-04
Remediation Due
2025-09-25
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53690
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| sitecore | experience_commerce | < 9.0 |
| sitecore | experience_manager | < 9.0 |
| sitecore | experience_platform | < 9.0 |
| sitecore | managed_cloud | - |
References & Advisories (3)
Vendor Advisory
US Government Resource
Exploit
Third Party Advisory