Detections
Analytics

CVE-2025-53690

critical

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

References

https://securityaffairs.com/186999/breaking-news/china-linked-apt-uat-8837-targets-north-american-critical-infrastructure.html

https://www.bleepingcomputer.com/news/security/china-linked-hackers-exploited-sitecore-zero-day-for-initial-access/

https://thehackernews.com/2026/01/china-linked-apt-exploits-sitecore-zero.html

https://therecord.media/china-hackers-apt-cisco-talos

https://blog.talosintelligence.com/uat-8837/

https://securityaffairs.com/182120/hacking/u-s-cisa-adds-dassault-systemes-delmia-apriso-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://hackread.com/zero-day-sitecore-exploited-deploy-weepsteel-malware/

https://therecord.media/cisa-orders-patch-for-sitecore-zero-day

https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html

https://securityaffairs.com/181924/breaking-news/u-s-cisa-adds-sitecore-android-and-linux-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.theregister.com/2025/09/04/unknown_miscreants_snooping_around_sitecore/

https://www.securityweek.com/hackers-exploit-sitecore-zero-day-for-malware-delivery/

https://www.infosecurity-magazine.com/news/sitecore-patches-exploited/

https://www.helpnetsecurity.com/2025/09/04/sitecore-zero-day-vulnerability-cve-2025-53690-exploited/

https://www.databreachtoday.com/attackers-exploit-sitecore-zero-day-a-29365

https://www.darkreading.com/vulnerabilities-threats/sitecore-zero-day-viewstate-threats

https://www.cisa.gov/news-events/alerts/2025/09/04/cisa-adds-three-known-exploited-vulnerabilities-catalog

https://www.bleepingcomputer.com/news/security/hackers-exploited-sitecore-zero-day-flaw-to-deploy-backdoors/

https://cyberscoop.com/sitecore-zero-day-vulnerability/

https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865

https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability

Details

Source: Mitre, NVD

Published: 2025-09-03

Updated: 2025-10-30

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.09739

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest