PT-2025-35315 · Sitecore · Sitecore Experience Platform+1

Piotr Bazydlo · Published 2025-08-29 · Updated 2025-09-15 · CVE-2025-53694

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager (XM) versions 9.2 through 10.4 Sitecore Experience Platform (XP) versions 9.2 through 10.4

Description A flaw exists that can lead to the exposure of sensitive information to an unauthorized actor in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP).

Recommendations Update Sitecore Experience Manager (XM) to a version later than 10.4. Update Sitecore Experience Platform (XP) to a version later than 10.4.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-53694

Affected Products

Sitecore Experience Manager

Sitecore Experience Platform

References · 13

• 🔥 https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53694 · Security Note
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53694 · Vendor Advisory
• https://t.me/cveNotify/134666 · Telegram Post
• https://twitter.com/TechNadu/status/1961733284792287639 · Twitter Post
• https://reddit.com/r/TechNadu/comments/1n3y2w8/sitecore_exploit_chain_links_cache_poisoning_rce · Reddit Post
• https://twitter.com/CVEnew/status/1963238379778384024 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1n3g4rq/researchers_warn_of_sitecore_exploit_chain · Reddit Post
• https://twitter.com/Cloudforce_One/status/1967695256037757364 · Twitter Post
• https://t.me/aptreports/21676 · Telegram Post
• https://twitter.com/cracbot/status/1965007275300381102 · Twitter Post
• https://t.me/CVEtracker/31595 · Telegram Post