PT-2025-35314 · Sitecore · Sitecore

Piotr Bazydlo

·

Published

2025-08-29

·

Updated

2025-09-08

·

CVE-2025-53693

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager (XM) versions 9.0 through 9.3, 10.0 through 10.4 Sitecore Experience Platform (XP) versions 9.0 through 9.3, 10.0 through 10.4
Description This issue involves the use of externally-controlled input to select classes or code ('Unsafe Reflection'), leading to cache poisoning. This can potentially allow for remote code execution.
Recommendations Sitecore Experience Manager (XM) versions 9.0 through 9.3 and 10.0 through 10.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sitecore Experience Platform (XP) versions 9.0 through 9.3 and 10.0 through 10.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2025-53693

Affected Products

Sitecore