PT-2025-35313 · Sitecore · Sitecore Experience Platform+1

Piotr Bazydlo · Published 2025-08-29 · Updated 2025-09-08 · CVE-2025-53691

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager (XM) versions 9.0 through 9.3, 10.0 through 10.4 Sitecore Experience Platform (XP) versions 9.0 through 9.3, 10.0 through 10.4

Description A deserialization of untrusted data issue exists in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP), potentially allowing for Remote Code Execution (RCE).

Recommendations Sitecore Experience Manager (XM) versions 9.0 through 9.3 should be updated. Sitecore Experience Manager (XM) versions 10.0 through 10.4 should be updated. Sitecore Experience Platform (XP) versions 9.0 through 9.3 should be updated. Sitecore Experience Platform (XP) versions 10.0 through 10.4 should be updated.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-53691

Affected Products

Sitecore Experience Manager

Sitecore Experience Platform

References · 19

• 🔥 https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce · Exploit
• https://osv.dev/vulnerability/CVE-2025-53691 · Vendor Advisory
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53691 · Security Note
• https://twitter.com/mveracf/status/1964259942237434206 · Twitter Post
• https://twitter.com/CFchangelog/status/1964259942174507255 · Twitter Post
• https://t.me/aptreports/21678 · Telegram Post
• https://reddit.com/r/TechNadu/comments/1n3y2w8/sitecore_exploit_chain_links_cache_poisoning_rce · Reddit Post
• https://reddit.com/r/SecOpsDaily/comments/1n3g4rq/researchers_warn_of_sitecore_exploit_chain · Reddit Post
• https://twitter.com/cracbot/status/1965007271676530727 · Twitter Post
• https://t.me/cveNotify/134672 · Telegram Post
• https://twitter.com/Cloudforce_One/status/1963550154805710963 · Twitter Post
• https://twitter.com/TechNadu/status/1961733284792287639 · Twitter Post
• https://twitter.com/CVEnew/status/1963238377882575218 · Twitter Post
• https://twitter.com/SecAideInfo/status/1964270499644477682 · Twitter Post