CVE-2025-53691

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Score

CVSS 3.1 8.8 High

Status

Analyzed - 9947ef80-c5d5-474a-bbab-97341a59000e

Published

2025-09-03

Last modified

2026-10-18

Weaknesses

CWE-502

Affected products

• Experience Commerce (Sitecore)
• Experience Manager (Sitecore)
• Experience Manager Xm (Sitecore)
• Experience Platform (Sitecore)
• Experience Platform Xp (Sitecore)
• Managed Cloud (Sitecore)

References

• https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667