CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization

What is CVE-2025-53691?

CVE-2025-53691 is a high-severity unsafe deserialization vulnerability in Sitecore Experience Manager (XM), published on 3 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Weakness: CWE-502

Which versions are affected by CVE-2025-53691?

It affects 4 products.

Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.

How do I fix CVE-2025-53691?

No fix has been published for CVE-2025-53691 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-53691 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53691 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Sitecore Experience Manager (XM)

• CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data Exploited Critical 9.0
• CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections Critical 9.8
• CVE-2023-35813 Code injection in n/a Critical 9.8
• CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip High 8.8
• CVE-2025-34511 Sitecore PowerShell Extension RCE via Unrestricted Upload High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cpg3-c796-vg5v.