CVE-2025-53691

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/	Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sitecore:experience_commerce::::::::
	cpe:2.3:a:sitecore:experience_manager::::::::
	cpe:2.3:a:sitecore:experience_platform::::::::
	cpe:2.3:a:sitecore:experience_platform:10.4:-::::::
	cpe:2.3:a:sitecore:managed_cloud:-:::::::*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de deserialización de datos no confiables en Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) permite la ejecución remota de código (RCE). Este problema afecta a Experience Manager (XM): desde 9.0 hasta 9.3, desde 10.0 hasta 10.4; Experience Platform (XP): desde 9.0 hasta 9.3, desde 10.0 hasta 10.4.

Information

Published : 2025-09-03 13:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-53691

Mitre link : CVE-2025-53691

CVE.ORG link : CVE-2025-53691

JSON object : View

Products Affected

sitecore

experience_manager
experience_commerce
experience_platform
managed_cloud

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-53691", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-53691", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-03T13:49:10.233307Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9947ef80-c5d5-474a-bbab-97341a59000e", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "9947ef80-c5d5-474a-bbab-97341a59000e", "affectedData": [{"vendor": "Sitecore", "product": "Experience Manager (XM)", "versions": [{"status": "affected", "version": "9.0", "versionType": "semver", "lessThanOrEqual": "9.3"}, {"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.4"}], "defaultStatus": "unaffected"}, {"vendor": "Sitecore", "product": "Experience Platform (XP)", "versions": [{"status": "affected", "version": "9.0", "versionType": "semver", "lessThanOrEqual": "9.3"}, {"status": "affected", "version": "10.0", "versionType": "semver", "lessThanOrEqual": "10.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-03T13:15:49.297", "references": [{"url": "https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/", "tags": ["Exploit", "Third Party Advisory"], "source": "9947ef80-c5d5-474a-bbab-97341a59000e"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667", "tags": ["Vendor Advisory"], "source": "9947ef80-c5d5-474a-bbab-97341a59000e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9947ef80-c5d5-474a-bbab-97341a59000e", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4."}, {"lang": "es", "value": "La vulnerabilidad de deserializaci\u00f3n de datos no confiables en Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) permite la ejecuci\u00f3n remota de c\u00f3digo (RCE). Este problema afecta a Experience Manager (XM): desde 9.0 hasta 9.3, desde 10.0 hasta 10.4; Experience Platform (XP): desde 9.0 hasta 9.3, desde 10.0 hasta 10.4."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCF77DC5-9DF9-4DF7-9636-69CA4BEEDB04", "versionEndIncluding": "10.4", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17EF29D0-E1DA-4F84-95F4-EA9680EB47DF", "versionEndIncluding": "10.4", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88455751-A525-4A59-9DD8-4E015CD1346C", "versionEndExcluding": "10.4", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E71AD1-04C7-4D80-9A0A-E386A3FAC860"}, {"criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0"}], "operator": "OR"}]}], "sourceIdentifier": "9947ef80-c5d5-474a-bbab-97341a59000e"}