Critical · published September 4, 2025
CVSS calls it critical at 9.0. It is confirmed in active exploitation. It sits in the 99.1th percentile for exploit probability.
🚨 A sneaky deserialization flaw is lurking in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP) up to version 9.0! This vulnerability opens the door for code injection, and believe me, that's no small matter! 🔥 Think of it like accepting a mystery package at your front door without checking the return label. If you let it inside, it could be filled with all sorts of mischief, just like how untrusted data can execute malicious code when improperly handled! An attacker exploiting this vulnerability could inject their own code into your system, potentially allowing them to take full control, access sensitive data, or even disrupt services entirely. The consequences could be absolutely devastating for your organization!
Think of it like accepting a mystery package at your front door without checking the return label. If you let it inside, it could be filled with all sorts of mischief, just like how untrusted data can execute malicious code when improperly handled! This deserialization of untrusted data vulnerability enables attackers to inject malicious code into the application, exploiting how the system processes serialized objects without proper validation.
An attacker exploiting this vulnerability could inject their own code into your system, potentially allowing them to take full control, access sensitive data, or even disrupt services entirely. The consequences could be absolutely devastating for your organization! Immediate action is crucial! Update Sitecore Experience Manager (XM) and Experience Platform (XP) to version 9.1 or higher to patch this vulnerability. Additionally, review your application’s data handling routines to ensure robust input validation and sanitization. Stay vigilant and proactive! Follow these steps, and you’ll bolster your defenses in no time. You've got this! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sitecore/experience_commerce | ≤ 9.0 | — |
| sitecore/experience_manager | ≤ 9.0 | — |
| sitecore/experience_platform | ≤ 9.0 | — |
| sitecore/managed_cloud | all versions | — |