Introduction
Remote code execution through a single HTTP request has been observed in real-world attacks against enterprise content management systems. Sitecore Experience Manager (XM) and Experience Platform (XP) are widely deployed in large organizations for digital experience management and content delivery. CVE-2025-53690, a critical vulnerability in these platforms, lets attackers inject and execute arbitrary code through insecure deserialization of untrusted data.
About Sitecore: Sitecore is a major enterprise digital experience and content management platform, used by thousands of organizations globally across finance, healthcare, government, and retail. It is built on .NET, has an extensive feature set, and large enterprises rely on it heavily for digital transformation work. Its ecosystem includes multiple products and integrations, so its security posture matters to the broader tech industry.
Technical Information
CVE-2025-53690 is classified under CWE-502, deserialization of untrusted data. It affects Sitecore Experience Manager (XM) and Experience Platform (XP) through version 9.0. The flaw occurs when Sitecore processes serialized .NET objects from untrusted sources without adequate validation or sanitization. Attackers can craft malicious serialized payloads, often with tools like ysoserial.net, and send them in HTTP requests to endpoints that accept serialized data.
When the Sitecore application deserializes these objects, attacker-controlled code can run within the context of the application pool identity. This can lead to full remote code execution, persistent backdoors, and lateral movement within the enterprise network. Earlier Sitecore vulnerabilities of this kind involved HTTP headers or parameters that accept serialized objects, such as the ThumbnailsAccessToken header (see CVE-2025-27218).
Exploitation typically follows this sequence:
- Reconnaissance to identify Sitecore installations and vulnerable endpoints
- Crafting malicious serialized .NET objects with embedded payloads
- Delivering the payload via HTTP to the vulnerable endpoint
- Triggering deserialization and code execution on the target system
No public snippets of the vulnerable code are available for this CVE. The exploit details are consistent with previous Sitecore deserialization flaws.
Affected Systems and Versions
- Sitecore Experience Manager (XM): through 9.0
- Sitecore Experience Platform (XP): through 9.0
All configurations of these versions are vulnerable if they process serialized data from untrusted sources.
Vendor Security History
Sitecore has had several critical deserialization vulnerabilities in recent years, including:
- CVE-2025-27218: Deserialization flaw in Sitecore 10.4
- CVE-2019-9874 and CVE-2019-9875: Added to CISA's Known Exploited Vulnerabilities catalog
- Additional 2025 vulnerabilities: CVE-2025-53691, CVE-2025-53693, CVE-2025-53694
Patch response times have varied. Some issues were addressed quickly, and others required multiple updates. The repeated deserialization flaws point to ongoing problems with secure input handling and serialization practices.
