CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
Untrusted data deserialization in Sitecore XM and XP allows attackers to execute arbitrary code, requiring immediate upgrades.
- Exploited in the wild
- Since 4 Sep 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53690?
CVE-2025-53690 is a critical unsafe deserialization vulnerability in Sitecore Experience Manager (XM), published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Weakness: CWE-502
Which versions are affected by CVE-2025-53690?
It affects 4 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.
How do I fix CVE-2025-53690?
No fix has been published for CVE-2025-53690 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Sep 2025.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-53690 being exploited?
Yes. Attackers have exploited CVE-2025-53690 in the wild since at least 4 Sep 2025.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Sitecore Experience Manager (XM)
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2023-35813 Code injection in n/a
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
- CVE-2025-34511 Sitecore PowerShell Extension RCE via Unrestricted Upload
Sources
Also known as GHSA-g5r9-cgwv-wmpc.