VULNERABILITY INTELLIGENCE

CVE-2025-53690

CVSS score9 CRITICAL

EPSS probability60.60%

CISA KEVKnown exploited vulnerability

Published2025-09-03

Last modified2026-10-18

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Vendor / product: Sitecore / Multiple Products

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Weakness classification

CWE-502: Deserialization of Untrusted Data

Primary references

9947ef80-c5d5-474a-bbab-97341a59000e — Exploit, Third Party Advisory
9947ef80-c5d5-474a-bbab-97341a59000e — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource