Unrated severityNVD Advisory· Published Sep 3, 2025· Updated Sep 3, 2025
Sitecore Experience Remote Code Execution through Insecure Deserialization
CVE-2025-53691
Description
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Affected products
4- Range: >=9.0 <=9.3, >=10.0 <=10.4
- Range: >=9.0 <=9.3, >=10.0 <=10.4
- Sitecore/Experience Manager (XM)v5Range: 9.0
- Sitecore/Experience Platform (XP)v5Range: 9.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.