CVE-2025-53691CWE-502insecure-deserialization

CVE-2025-53691

High · published September 3, 2025

CVSS v3.1
8.8
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01636 · 76.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-09-03T17:15Z
Affected products (5)
ProductVersionsFixed in
sitecore/experience_commerce≥ 9.0, ≤ 10.4—
sitecore/experience_manager≥ 9.0, ≤ 10.4—
sitecore/experience_platform≥ 9.0, < 10.410.4
sitecore/experience_platformall versions—
sitecore/managed_cloudall versions—
References (2)
https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ · 9947ef80-c5d5-474a-bbab-97341a59000ehttps://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 · 9947ef80-c5d5-474a-bbab-97341a59000e
EPSS history
Timeline
  • 03 SEP 12:36Z
    Sitecore Experience Remote Code Execution through Insecure Deserialization
    cvelistv5