PoC Index

CVE-2025-53690

KEVCRITICAL 9.0EPSS 51.1%

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

CVSS v3.1
9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
51.09% chance of exploitation in the next 30 days, 99th percentile
CISA KEV
added 2025-09-04
Published
2025-09-03
Updated
2026-02-26

Proof-of-concept exploits (2)

References

Related