CVE-2025-53690 is a ViewState deserialization vulnerability affecting on-premises Sitecore Experience Manager/Platform deployments that still rely on static, publicly disclosed ASP.NET machine keys shipped in old Sitecore sample configurations — an unauthenticated attacker who knows the leaked key can forge a ViewState payload that Sitecore deserializes into arbitrary code execution, and Google's Mandiant/GTIG team has documented active exploitation of exactly this pattern.
Vulnerability summary
9
Critical
60.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-09-03
Published
Vulnerability ID: CVE-2025-53690 · Source: NVD (Wiz Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Sitecore Experience Manager (XM) | cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:* | through 9.0 |
| Sitecore Experience Platform (XP) | cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:* | through 9.0 |
| Sitecore Experience Commerce (XC) | cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:* | through 9.0 (per NVD CPE applicability data; not named in Sitecore's own bulletin text, which focuses on XM/XP/Managed Cloud) |
| Sitecore Managed Cloud | cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:* | deployments (Standard and Premium tiers) using customer-managed static machine keys |
What this means
CVE-2025-53690 is a deserialization of untrusted data vulnerability (CWE-502) in Sitecore. NVD's description states: "Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection. This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0" (NVD).
The only CVSS data NVD has on record is a Secondary score submitted by Wiz: CVSS v3.1 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. As of this writing NVD has not published its own independent Primary CVSS metric for this CVE, so this page reports the Wiz figure honestly as not NVD-confirmed rather than attributing it to NVD (NVD).
Sitecore's own security bulletin (SC2025-005) explains the root cause: affected deployments use "publicly disclosed, static ASP.NET machine keys" — organizations that built their site from Sitecore XP 9.0-or-earlier sample configuration files (including ones bundled with Sitecore Active Directory 1.4) are at particular risk, as are multi-instance deployments sharing a customer-managed static key. Sitecore's recommended remediation is to rotate machine keys in web.config immediately, encrypt the machineKey element, restrict file access to administrators only, and adopt ongoing key-rotation practice. The bulletin lists Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC) and Managed Cloud (Standard and Premium) as affected, while stating that SitecoreAI, Content Hub, CDP, OrderCloud and other fully cloud-hosted offerings are not affected (Sitecore Security Bulletin SC2025-005).
Google Cloud's threat intelligence group documented active exploitation of this exact weakness: attackers used publicly available static ASP.NET machine keys to forge ViewState payloads against on-premises Sitecore deployments for code execution, in a wave of activity that the researchers note correlates with broader exploitation targeting on-prem enterprise web platforms around the same period, including the SharePoint ViewState/deserialization chain tracked as CVE-2025-53770/53771 (Google Cloud Threat Intelligence).
CISA added CVE-2025-53690 to the Known Exploited Vulnerabilities catalog, with a required-action due date of 2025-09-25 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.6060 (99.142th percentile) — very high, consistent with confirmed in-the-wild use (FIRST EPSS).
Because the underlying flaw is a leaked, publicly known cryptographic key rather than a patchable code defect, applying a Sitecore update alone does not remediate an at-risk instance: operators must audit web.config for any machine key matching a publicly disclosed sample value, rotate it immediately, encrypt the stored key, and investigate for prior ViewState-based compromise.
Evidence
- Deserialization of untrusted data in Sitecore Experience Manager (XM) and Experience Platform (XP), through version 9.0, allows code injection. — NVD
- Only CVSS data on record is a Wiz-submitted Secondary score, CVSS v3.1 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; no NVD Primary metric published as of this writing. — NVD
- Root cause is publicly disclosed, static ASP.NET machine keys from old Sitecore sample configurations; affects XM, XP, XC and Managed Cloud; remediation is rotating and encrypting the machine key, not just patching. — Sitecore Security Bulletin SC2025-005
- Attackers exploited publicly available static ASP.NET machine keys to forge ViewState payloads against on-premises Sitecore deployments for code execution, correlating with other on-prem ViewState exploitation activity in the same period. — Google Cloud Threat Intelligence
- Added to the CISA Known Exploited Vulnerabilities catalog, required-action due date 2025-09-25. — CISA KEV
- EPSS score is 0.6060 (99.142th percentile) as of 2026-10-29. — FIRST EPSS
