CVE-2025-53690
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-53690 is a critical deserialization of untrusted data vulnerability affecting multiple Sitecore products including Experience Manager (XM), Experience Platform (XP), and Experience Commerce, through version 9.0. The vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary code on the server through malicious serialized data. With a CVSS v3.1 base score of 9.0 and a changed scope, successful exploitation can compromise not only the Sitecore application but also the underlying server infrastructure. CISA has added CVE-2025-53690 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 25, 2025, and the EPSS score of 9.51% at the 93rd percentile signals high exploitation probability for this Sitecore deserialization vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sitecore | experience commerce | <= 9.0 |
| sitecore | experience manager | <= 9.0 |
| sitecore | experience platform | <= 9.0 |
| sitecore | managed cloud | - |
References
- https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability(Exploit, Third Party Advisory)
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-53690 is classified under CWE-502 (Deserialization of Untrusted Data), a weakness where the application deserializes data from an untrusted source without proper validation. In Sitecore's web application framework, the ViewState deserialization mechanism processes serialized .NET objects from HTTP requests without adequately verifying their contents, enabling an attacker to supply crafted payloads that execute arbitrary code when deserialized by the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2025-53690 carries a CVSS v3.1 base score of 9.0 (Critical severity) with high attack complexity (AC:H), no authentication required (PR:N), no user interaction needed (UI:N), and a changed scope (S:C). Confidentiality faces high impact because remote code execution allows the attacker to access all data managed by the Sitecore platform, including customer data, content management assets, e-commerce transaction records, and database credentials. Integrity faces high impact as the attacker can modify website content, inject malicious scripts into pages served to visitors, alter e-commerce data, and plant persistent backdoors. Availability is also at high risk because the attacker can disrupt the Sitecore platform, take the website offline, or consume server resources. The changed scope indicates that compromising Sitecore can affect the underlying Windows server, IIS web server, SQL Server databases, and other systems in the hosting environment. The EPSS score of 9.51% at the 93rd percentile indicates high exploitation probability, and content management systems are frequent targets because they are internet-facing and often contain valuable business data.
Exploit Maturity
CVE-2025-53690 demonstrates high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. Detailed exploitation research is publicly available through Google Cloud Threat Intelligence, which documents how ViewState deserialization has been weaponized against Sitecore installations. The EPSS score of 9.51% at the 93rd percentile confirms high exploitation probability. Sitecore's ViewState deserialization vulnerability follows a well-known .NET exploitation pattern where attackers leverage insecure deserialization of ASP.NET ViewState to achieve remote code execution. The ransomware association is currently classified as unknown. The availability of public threat intelligence research and the confirmed KEV status indicate that multiple threat actors are actively targeting vulnerable Sitecore deployments, making immediate patching essential for organizations running Sitecore Experience Manager, Experience Platform, or Experience Commerce.
Remediation
-
Apply Sitecore's security patches immediately as described in the Sitecore knowledge base article KB1003865. Follow the vendor's specific guidance for upgrading or patching your Sitecore XM, XP, or Experience Commerce installation beyond version 9.0.
-
Validate ViewState configuration to ensure that ViewState MAC (Message Authentication Code) validation is enabled and properly configured. An improperly configured or disabled ViewState MAC is the primary attack vector for this deserialization vulnerability. Verify that the machine key is unique, strong, and not using default values.
-
Implement a Web Application Firewall (WAF) with rules that detect and block deserialization attack payloads in HTTP requests. Configure the WAF to inspect request bodies for known .NET deserialization gadget chain signatures.
-
Conduct a forensic investigation of Sitecore servers that were running vulnerable versions while exposed to the internet. Check for web shells, unauthorized files in the web root, unexpected IIS application pools or worker processes, and unusual outbound network connections. Review IIS logs for suspicious POST requests containing large or unusual ViewState values.
-
Isolate Sitecore servers from critical internal systems using network segmentation. Ensure the Sitecore application server cannot directly access sensitive internal databases, file shares, or management networks beyond what is strictly required for application functionality.
Technical Details
CVE-2025-53690 is a deserialization of untrusted data vulnerability (CWE-502) in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce, and Managed Cloud through version 9.0. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a network-accessible attack with high complexity, no authentication, and a changed scope with maximum CIA impact. The vulnerability targets the ASP.NET ViewState deserialization mechanism used by Sitecore. ViewState is a mechanism in ASP.NET web forms that serializes and deserializes page state between HTTP requests. When ViewState MAC validation is not properly enforced or can be bypassed, an attacker can craft a malicious serialized .NET object and submit it as part of the ViewState field in an HTTP POST request. The Sitecore application server deserializes this data without adequate type restrictions, causing the malicious object to execute arbitrary code with the privileges of the IIS application pool identity. The high attack complexity rating reflects the need for specific environmental conditions, such as knowledge of the machine key or a misconfigured ViewState MAC, but publicly available tooling and research have made exploitation practical. The Google Cloud Threat Intelligence report documents this attack pattern in detail, including how threat actors target Sitecore installations specifically.
Frequently Asked Questions
Is CVE-2025-53690 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-53690 to the KEV catalog. Google Cloud Threat Intelligence has published research documenting ViewState deserialization attacks targeting Sitecore installations. The EPSS score of 9.51% at the 93rd percentile confirms high exploitation probability.
What products are affected by CVE-2025-53690?
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce through version 9.0 are affected. Sitecore Managed Cloud is also listed as affected. Organizations running any of these products should apply patches immediately.
How do I fix CVE-2025-53690?
Apply the patches described in Sitecore knowledge base article KB1003865. Ensure ViewState MAC validation is properly enabled with a strong, unique machine key. Consider upgrading to a Sitecore version beyond 9.0 that is not affected by this vulnerability.
How severe is CVE-2025-53690?
CVE-2025-53690 is rated Critical with a CVSS v3.1 base score of 9.0. The deserialization vulnerability enables remote code execution without authentication. The changed scope means compromise of Sitecore can lead to full server infrastructure compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.