Exploit / PoCcritical
Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP | 9.0 | 61% | KEVPoC | KEV |
From the original article
3 min read at helpnetsecurity.com
A threat actor is leveraging a zero-day vulnerability (CVE-2025-53690) and an exposed sample ASP. NET machine key to breach internet-facing, on-premises deployments of several Sitecore solutions, Mandiant has revealed. CVE-2025-53690 is a ViewState deserialization vulnerability that affects any version of Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.