CVE-2025-53690

Sitecore Products ViewState Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Affected

Sitecore · Experience Manager (XM) · Experience Platform (XP)

CVSS v3.1 CNA

9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

60.60% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2025-09-04

Published

2025-09-03

Updated

2026-02-26

Proof-of-concept exploits (2)

• rxerium/CVE-2025-536905★ · 2025-10-14
• ErikLearningSec/CVE-2025-53690-POC8★ · 2025-11-05

Security advisories

• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
• https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-d…

References

• CVE Record
• NVD entry

Related

• CVE-2022-24086
• CVE-2022-41352
• CVE-2023-22515
• CVE-2023-40000
• CVE-2023-6000
• CVE-2024-12084