Unsafe Reflection Vulnerability in Sitecore Experience Manager and Experience Platform
CVE-2025-53693

9.8CRITICAL

Key Information:

Vendor

Sitecore

Status
Sitecore Experience Manager (xm)
Experience Platform (xp)
Vendor
CVE Published:
3 September 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-53693?

The vulnerability in Sitecore Experience Manager and Experience Platform arises from the use of external inputs that could lead to unsafe reflection, enabling attackers to manipulate application behavior. As a result, this could allow for cache poisoning, potentially compromising sensitive information and disrupting services. Affected versions include Sitecore Experience Manager (XM) from 9.0 to 9.3 and 10.0 to 10.4, as well as Sitecore Experience Platform (XP) from 9.0 to 9.3 and 10.0 to 10.4.

Affected Version(s)

Experience Platform (XP) 9.0 <= 9.3

Experience Platform (XP) 10.0 <= 10.4

Sitecore Experience Manager (XM) 9.0 <= 9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-53693
Created by blueisbeautiful

References

https://labs.watchtowr.com/cache-me-if-you-can-sitecore-e...
https://support.sitecore.com/kb?id=kb_article_view&syspar...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

Credit

Piotr Bazydlo of watchTowr
.
CVE-2025-53693 : Unsafe Reflection Vulnerability in Sitecore Experience Manager and Experience Platform