Deserialization Vulnerability in Sitecore Experience Manager and Platform
CVE-2025-53691

8.8HIGH

Key Information:

Vendor

Sitecore

Status
Experience Manager (xm)
Experience Platform (xp)
Vendor
CVE Published:
3 September 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-53691?

A deserialization of untrusted data vulnerability has been identified in Sitecore Experience Manager (XM) and Experience Platform (XP). This security flaw allows attackers to manipulate the deserialization process, potentially leading to remote code execution (RCE). Affected versions include Experience Manager (XM) versions 9.0 through 9.3 and 10.0 through 10.4, as well as Experience Platform (XP) versions 9.0 through 9.3 and 10.0 through 10.4. It is critical for organizations using these platforms to assess their risk and implement necessary patches.

Affected Version(s)

Experience Manager (XM) 9.0 <= 9.3

Experience Manager (XM) 10.0 <= 10.4

Experience Platform (XP) 9.0 <= 9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-53691
Created by blueisbeautiful

References

https://labs.watchtowr.com/cache-me-if-you-can-sitecore-e...
https://support.sitecore.com/kb?id=kb_article_view&syspar...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

Credit

Piotr Bazydlo of watchTowr
.
CVE-2025-53691 : Deserialization Vulnerability in Sitecore Experience Manager and Platform