Skip to main content

Experience Commerce CVE-2025-53690

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2025-09-03 9947ef80-c5d5-474a-bbab-97341a59000e
Deserialization Experience Commerce Experience Manager Experience Platform Managed Cloud
9.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.0 CRITICAL
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 19:10 vuln.today
Added to CISA KEV
Oct 30, 2025 - 20:39 cisa
CISA KEV
PoC Detected
Oct 30, 2025 - 20:39 vuln.today
Public exploit code
CVE Published
Sep 03, 2025 - 20:15 nvd
CRITICAL 9.0

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

AnalysisAI

Sitecore Experience Manager/Platform through version 9.0 contains a deserialization vulnerability enabling code injection through untrusted data processing.

Technical ContextAI

The CWE-502 deserialization processes untrusted data that can contain malicious serialized .NET objects for code execution.

RemediationAI

Apply Sitecore security patches. Implement .NET serialization filtering.

More in Experience Commerce

View all
CVE-2025-34510 HIGH POC
8.8 Jun 17

Sitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
CVE-2025-34511 HIGH POC
8.8 Jun 17

Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
CVE-2025-34509 HIGH POC
7.5 Jun 17

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
CVE-2023-35813 CRITICAL POC
9.8 Jun 17

Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
CVE-2025-53694 HIGH POC
7.5 Sep 03

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
CVE-2024-46938 HIGH POC
7.5 Sep 15

An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0

CVE-2023-33651 HIGH POC
7.5 Jun 06

An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
CVE-2025-53693 CRITICAL POC
9.8 Sep 03

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Ex
CVE-2025-53691 HIGH POC
8.8 Sep 03

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) a

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2017-3066 CRITICAL POC
9.8

Share

CVE-2025-53690 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy