CVE-2025-53691

HIGH

Sitecore XM/X - RCE

Title source: llm

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Exploits (2)

github WORKING POC

by brokendreamsclub · pythonpoc

https://github.com/brokendreamsclub/CVE-2025-53694-to-CVE-2025-53691

View Code ZIP pw:eip

nomisec WORKING POC

by brokendreamsclub · poc

https://github.com/brokendreamsclub/CVE-2025-53691

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/

[Vendor Advisory] https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667

Scores

CVSS v3 8.8

EPSS 0.0334

EPSS Percentile 87.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (5)

sitecore/experience_commerce < 10.4

sitecore/experience_manager < 10.4

sitecore/experience_platform < 10.4

sitecore/experience_platform

sitecore/managed_cloud

Timeline

Published Sep 03, 2025

Tracked Since Feb 18, 2026