Sitecore zero-day vulnerability springs up from exposed machine key
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP | 9.0 | 61% | KEVPoC | KEV |
From the original article
3 min read at cyberscoop.com
The actively exploited defect, triggered by an attacker’s use of a publicly available sample machine key, underscores the vendor and customers’ poor configuration practices. An attacker exploited a zero-day vulnerability in Sitecore stemming from a misconfiguration of public ASP. NET machine keys that customers implemented based on the vendor’s documentation, according to researchers.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.