CVE-2025-53693

CVE-2025-53693 is an unsafe-reflection flaw (CWE-470) in Sitecore Experience Manager (XM) and Experience Platform (XP) in which externally controlled input can select classes or code and poison the cache. It is reachable over the network with low complexity, no privileges, and no user interaction, and is scored CVSS 3.1 9.8 with high impact on confidentiality, integrity, and availability. Public research describes the cache-poisoning issue as part of an exploit chain that can lead to remote code execution. Affected releases are XM and XP from 9.0 through 9.3 and from 10.0 through 10.4. A public proof-of-concept write-up exists and the 30-day exploitation probability is about 20 percent, but the CVE is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply Sitecore's official fixes for CVE-2025-53693 on every Experience Manager (XM) and Experience Platform (XP) instance in the 9.0–9.3 and 10.0–10.4 ranges; this record does not name a patched build, so use the vendor advisory for the exact releases. Prioritize internet-facing servers, limit public access until they are updated, and review caches and logs for unexpected cached content or anomalous unauthenticated requests.