---
id: "CVE-2025-53690"
kind: "vulnerability"
aliases: ["CVE-2025-53690"]
title: "Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform\u2026"
severity: "critical"
cvss: 9.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Sitecore Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sitecore experience commerce", "fixed": [], "affected": "<= 9.0", "ecosystem": "vendor"}, {"name": "sitecore experience manager", "fixed": [], "affected": "<= 9.0", "ecosystem": "vendor"}, {"name": "sitecore experience platform", "fixed": [], "affected": "<= 9.0", "ecosystem": "vendor"}, {"name": "sitecore managed cloud", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asp.net", "exploited", "sitecore", "vendor", "windows"]
not_affected_if: ["non-sitecore"]
published_at: "2025-09-03T20:15:33+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53690", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53690", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform…

Sitecore Experience Manager, Experience Platform, Experience Commerce and Managed Cloud ship with default ASP.NET machine keys that are exposed. An attacker who knows or obtains those keys can send crafted serialized data and run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sitecore Multiple Products affected ? fixed ?
- vendor:sitecore experience commerce affected <= 9.0 fixed ?
- vendor:sitecore experience manager affected <= 9.0 fixed ?
- vendor:sitecore experience platform affected <= 9.0 fixed ?
- vendor:sitecore managed cloud affected ? fixed ?

## How to check

Check whether your Sitecore deployment uses the default ASP.NET machineKey values in web.config (validationKey and decryptionKey).

## Fix

Replace the default machine keys with unique keys per the Sitecore vendor instructions, then rotate any secrets they protected.
If mitigations are unavailable, CISA says to discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-53690
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-53690

## From the sources

Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_