Search/CVE-2025-53690
● CVE — Critical

CVE-2025-53690

VendorsitecoreProductexperience platform, experience manager, experience commerce, managed cloudDiscoveredSep 3, 2025UpdatedOct 30, 2025

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

View graph Watch Export
CVSS v3.1
9 CRITICAL
EPSS
60.6%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
3
sources referencing this CVE
Related IOCs
1
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 29.2pp
31.4% → 60.6% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Connections
8 relationships
Timeline
disclosure → media coverage
Sep 3, 2025
Disclosure — published as a CVE record. · last revised by NVD Oct 30, 2025
Sep 4, 2025
helpnetsecurity.com reports: Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)
Sep 5, 2025
thehackernews.com reports: CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation
Sep 7, 2025
helpnetsecurity.com reports: Week in review: Several companies affected by the Salesloft Drift breach, Sitecore 0-day vulnerability
Public PoC (3)
github.com/rxerium/CVE-2025-53690github.com/m0d0ri205/CVE-2025-53690-Analysisgithub.com/ErikLearningSec/CVE-2025-53690-POC
Unverified third-party code — review before executing.