{"id":"CVE-2025-53690","kind":"vulnerability","aliases":["CVE-2025-53690"],"related":[],"title":"Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform…","description":"Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Sitecore Experience Manager, Experience Platform, Experience Commerce and Managed Cloud ship with default ASP.NET machine keys that are exposed. An attacker who knows or obtains those keys can send crafted serialized data and run code on the server.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2025-09-04T00:00:00+00:00","products":[{"name":"Sitecore Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sitecore experience commerce","fixed":[],"affected":"<= 9.0","ecosystem":"vendor"},{"name":"sitecore experience manager","fixed":[],"affected":"<= 9.0","ecosystem":"vendor"},{"name":"sitecore experience platform","fixed":[],"affected":"<= 9.0","ecosystem":"vendor"},{"name":"sitecore managed cloud","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asp.net","exploited","sitecore","vendor","windows"],"not_affected_if":["non-sitecore"],"how_to_check":"Check whether your Sitecore deployment uses the default ASP.NET machineKey values in web.config (validationKey and decryptionKey).","fix":"Replace the default machine keys with unique keys per the Sitecore vendor instructions, then rotate any secrets they protected.\nIf mitigations are unavailable, CISA says to discontinue use of the product.","status":"open","published_at":"2025-09-03T20:15:33+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:53+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:44:53Z","model":"claude-haiku-5-5","output":{"fix":"Replace the default machine keys with unique keys per the Sitecore vendor instructions, then rotate any secrets they protected.\nIf mitigations are unavailable, CISA says to discontinue use of the product.","reach":"internet","summary":"Sitecore Experience Manager, Experience Platform, Experience Commerce and Managed Cloud ship with default ASP.NET machine keys that are exposed. An attacker who knows or obtains those keys can send crafted serialized data and run code on the server.","category":"vendor","who_cares":["sitecore","asp.net","windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote code execution on the Sitecore server via exposed machine keys.","analyst_note":"Find Sitecore's official advisory and mitigation steps for CVE-2025-53690 and confirm the exact machineKey setting to check.","how_to_check":"Check whether your Sitecore deployment uses the default ASP.NET machineKey values in web.config (validationKey and decryptionKey).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["non-sitecore"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000474,"input_tokens":2600,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':132C '-2025':15A,18A '-53690':16A,19A '22':131C 'achiev':116C 'action':122C 'allow':107C 'appli':123C 'applic':129C 'asp.net':35B,53B,112C 'attack':60B,108C 'bod':130C 'cisa':120C 'cloud':34A,49B,90C,135C 'code':74B,118C 'commerc':46B,86C 'commerce':25A 'contain':91C 'craft':69B 'cve':14A,17A 'data':4A,71B,96C 'default':52B,102C 'deseri':1A,93C 'discontinu':138C 'execut':119C 'experi':8A,12A,41B,43B,45B,79C,82C,85C 'experience':24A,27A,30A 'exploit':36B,110C 'expos':58B,111C 'flaw':106C 'follow':128C 'guidanc':133C 'instruct':127C 'involv':98C 'key':55B,66B,104C,114C 'know':62B 'machin':54B,103C,113C 'manag':9A,42B,48B,80C,89C 'managed':33A 'manager':28A 'mitig':124C,144C 'multiple':21A 'obtain':64B 'per':125C 'platform':13A,31A,44B,83C 'product':142C 'products':22A 'remot':117C 'requir':121C 'run':73B 'send':68B 'serial':70B 'server':77B 'servic':136C 'ship':50B 'sitecor':7A,11A,37B,40B,78C 'sitecore':20A,23A,26A,29A,32A 'unavail':146C 'untrust':3A,95C 'use':100C,139C 'vendor':38B,126C 'vulner':5A,97C 'window':39B 'xc':87C 'xm':10A,81C 'xp':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-03T20:15:33+00:00","kev":{"dateAdded":"2025-09-04","dueDate":"2025-09-25","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"9947ef80-c5d5-474a-bbab-97341a59000e","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-53690","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53690","severity":null,"published_at":"2025-09-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-53690","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53690","severity":null,"published_at":"2025-09-03T20:15:33+00:00","modified_at":"2026-10-18T21:10:00+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}