Critical severity · published Sep 3, 2025
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
In wildKEV
9.0
CVSS
60.6%
EPSS
Yes
On KEV
Description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)60.6% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 4, 2025
Federal remediation dueSep 25, 2025
Ransomware campaign useNot known
Affected products
Which versions
EM
Experience Manager (XM) · Sitecore
through 9.0 · source: vendor
EP
Experience Platform (XP) · Sitecore
through 9.0 · source: vendor
EC
Experience Commerce · Sitecore
through 9.0 · source: NVD
EM
Experience Manager · Sitecore
through 9.0 · source: NVD
EP
Experience Platform · Sitecore
through 9.0 · source: NVD
MC
Managed Cloud · Sitecore
All versions, or not specified · source: NVD
MP
Multiple Products · Sitecore
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53690
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
cloud.google.com
https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability
support.sitecore.com
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
More from Experience Manager (XM)
8.8
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
8.7
CVE-2025-34139
Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read