CVE-2025-53690

CriticalCVSS 9.0/10Known exploited (CISA KEV)Last modified Oct 18, 2026

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Sitecore	Experience Manager (XM)	<= 9.0
Sitecore	Experience Platform (XP)	<= 9.0

References

https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerabilityExploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690US Government Resource

Timeline

Published: Sep 3, 2025
Last modified: Oct 18, 2026
Added to CISA KEV: Sep 4, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-536918.8Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Ex CVE-2025-536927.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Ma CVE-2025-536939.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM CVE-2025-536947.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience P CVE-2025-536959.4OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' us CVE-2025-536969.3iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firm CVE-2025-53709.8A vulnerability classified as critical was found in PHPGurukul News Portal 4.1. Affected by this vulnerability is an unknown functionality o CVE-2025-537016.1Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET requests sent to /cgi-CVE-2025-537026.5Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might s CVE-2025-537037.5DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted by attackers.CVE-2025-537047.5The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.CVE-2025-537057.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper vali