PT-2025-35830 · Sitecore · Sitecore Experience Manager +1

Andi Slok

+4

·

Published

2025-09-03

·

Updated

2025-09-07

·

CVE-2025-53690

Report an issue
CVSS v3.1
9.0
VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Sitecore Experience Manager (XM), Sitecore Experience Platform (XP), Sitecore Experience Commerce (XC), and Managed Cloud versions prior to 9.0

Sitecore Active Directory versions 1.4 and earlier

**Description:**

A critical deserialization vulnerability (CVE-2025-53690) exists in Sitecore products, allowing for remote code execution (RCE). This issue stems from the use of a sample ASP.NET machine key included in Sitecore documentation prior to 2017, which was inadvertently used in production environments. Attackers exploit this by crafting malicious ViewState payloads, leading to RCE. The vulnerability is actively exploited, with attackers observed deploying the WEEPSTEEL malware for reconnaissance, establishing persistence through tools like DWAGENT and EARTHWORM, and attempting credential theft. Approximately 1.6 million services are potentially affected worldwide. The initial point of compromise often involves the `/sitecore/blocked.aspx` endpoint, which does not require authentication.

**Recommendations:**

Sitecore Experience Manager (XM) versions prior to 9.0: Replace all static `<machineKey>` values in `web.config` with unique keys and ensure the `<machineKey>` element within `web.config` is encrypted.

Sitecore Experience Platform (XP) versions prior to 9.0: Replace all static `<machineKey>` values in `web.config` with unique keys and ensure the `<machineKey>` element within `web.config` is encrypted.

Sitecore Experience Commerce (XC) versions prior to 9.0: Replace all static `<machineKey>` values in `web.config` with unique keys and ensure the `<machineKey>` element within `web.config` is encrypted.

Sitecore Managed Cloud versions prior to 9.0: Replace all static `<machineKey>` values in `web.config` with unique keys and ensure the `<machineKey>` element within `web.config` is encrypted.

Sitecore Active Directory versions 1.4 and earlier: Replace all static `<machineKey>` values in `web.config` with unique keys and ensure the `<machineKey>` element within `web.config` is encrypted.

Regularly rotate static keys as a preventative security measure.

Exploit

Fix

LPE

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-53690

Affected Products

Sitecore Experience Manager
Sitecore Experience Platform