Unsafe Reflection Vulnerability in Sitecore Experience Manager and Experience Platform
CVE-2025-53693

9.8CRITICAL

Key Information:

Vendor

Sitecore

Status
Sitecore Experience Manager (xm)
Experience Platform (xp)
Vendor
CVE Published:
3 September 2025

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%

What is CVE-2025-53693?

The vulnerability in Sitecore Experience Manager and Experience Platform arises from the use of external inputs that could lead to unsafe reflection, enabling attackers to manipulate application behavior. As a result, this could allow for cache poisoning, potentially compromising sensitive information and disrupting services. Affected versions include Sitecore Experience Manager (XM) from 9.0 to 9.3 and 10.0 to 10.4, as well as Sitecore Experience Platform (XP) from 9.0 to 9.3 and 10.0 to 10.4.

Affected Version(s)

Experience Platform (XP) 9.0 <= 9.3

Experience Platform (XP) 10.0 <= 10.4

Sitecore Experience Manager (XM) 9.0 <= 9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-53693
Created by blueisbeautiful

References

https://labs.watchtowr.com/cache-me-if-you-can-sitecore-e...
https://support.sitecore.com/kb?id=kb_article_view&syspar...

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

Credit

Piotr Bazydlo of watchTowr
.