Known Exploited Vulnerabilities September 04, 2025 · CISA KEV Catalog

CVE-2025-53690: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Summary: CVE-2025-53690 is a deserialization of untrusted data vulnerability in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud, involving the use of default machine keys. The flaw lets attackers exploit exposed ASP.NET machine keys to achieve remote code execution, and CISA has set a remediation due date of 2025-09-25.

What's compelling: Default machine keys left in place turn an exposed ASP.NET endpoint into remote code execution, and CISA's 2025-09-25 deadline puts Sitecore XM, XP, XC, and Managed Cloud deployments on a fixed clock.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2025-53690Sitecore

Related

CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Known Exploited Vulnerabilities · Mar 26, 2025

CVE-2019-9875: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability Known Exploited Vulnerabilities · Mar 26, 2025

CVE-2021-42237: Sitecore XP Remote Command Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022