CVE-2025-53691
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Sitecore Experience Remote Code Execution through Insecure Deserialization
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Experience Manager (XM)
- Vendor
- Sitecore
- Product
- Experience Manager (XM)
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 9.0 | affected | semver | Unavailable | 9.3 | None listed |
| 10.0 | affected | semver | Unavailable | 10.4 | None listed |
Experience Platform (XP)
- Vendor
- Sitecore
- Product
- Experience Platform (XP)
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 9.0 | affected | semver | Unavailable | 9.3 | None listed |
| 10.0 | affected | semver | Unavailable | 10.4 | None listed |