CVE-2025-53690

CriticalKnown Exploited

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code…

Wiz·CWE-502·Published 2025-09-03

CVSS

9.0

EPSS

0.26

KEV

Yes

Exploits

Attributed to:UAT-8837

cve.orgen

236 chars

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

NVDen

236 chars

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	NVD	9.0	2.2	6.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H