CVE-2025-53690
Published 2025-09-03 · Updated 2026-10-18 · Source 9947ef80-c5d5-474a-bbab-97341a59000e
Summary
CVE-2025-53690 is a critical-severity (CVSS 9.0) vulnerability in Sitecore Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on September 4, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 25, 2025. CISA does not currently list it as used in ransomware campaigns. Sitecore has 4 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.
All 4 known-exploited Sitecore vulnerabilities →Description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Sitecore — Multiple Products
Name: Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Date added: 2025-09-04 · Due: 2025-09-25
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.