CVE-2025-53694 Information Disclosure in ItemServices API
Unauthorized actors can access sensitive information via the ItemServices API in Sitecore Experience Manager and Platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53694?
CVE-2025-53694 is a high-severity vulnerability in Sitecore Experience Platform (XP), published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Weakness: CWE-200
Which versions are affected by CVE-2025-53694?
It affects 4 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.
How do I fix CVE-2025-53694?
No fix has been published for CVE-2025-53694 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-53694 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53694 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Sitecore Experience Platform (XP)
- CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2023-35813 Code injection in n/a
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Sources
Also known as GHSA-vmj4-jxq2-r8rx.