← Back

CVE-2025-53691

nvd nist
Published: Sep 3, 2025Modified: Sep 8, 2025

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: 9947ef80-c5d5-474a-bbab-97341a59000e (Secondary)

Description

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Affected (5)

Sitecore
4 products
Experience Commerce
Experience Manager
Experience Platform
Managed Cloud
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Experience Commerce
From 9.0 to 10.4
Experience Manager
From 9.0 to 10.4
Sitecore
Experience Platform
From 9.0 to 10.4
Experience Platform
Version 10.4
Managed Cloud
All versions

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

Source: 9947ef80-c5d5-474a-bbab-97341a59000e
ExploitThird Party Advisory
Source: 9947ef80-c5d5-474a-bbab-97341a59000e
Vendor Advisory

Timeline

No history available yet.