Mandiant Threat Defense uncovered CVE-2025-53690 and reported it to Sitecore, which publicly disclosed the vulnerability in September 2025 via security bulletin SC2025-005. It is a confirmed, actively exploited remote code execution vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP). Scored at CVSS 9.0, it lets attackers inject and run arbitrary code through a single HTTP request by exploiting insecure ViewState deserialization of untrusted data. CISA's KEV catalog includes this vulnerability, with exploitation traced back to at least December 2024.
TLDR:
- CVE-2025-53690 is a CVSS 9.0 ViewState deserialization RCE in Sitecore XM/XP/XC multi-instance deployments, actively exploited since December 2024.
- All versions of multi-instance XM, XP, and XC topologies are affected; single-instance deployments are not.
- Attackers forge valid ViewState payloads via an exposed machineKey and deliver RCE through a single HTTP request using
ysoserial.net. - Apply Sitecore bulletin SC2025-005 and rotate your machineKey; blocking internet access to affected instances buys time if you cannot patch immediately.
- CISA's BOD 26-04 sets a three-day remediation deadline for federal agencies, and auditors and insurers are expected to adopt the same standard across the private sector.
What is CVE-2025-53690?
CVE-2025-53690 is a deserialization of untrusted data vulnerability (CWE-502) in Sitecore's ASP.NET ViewState handling. Sitecore is a widely deployed .NET-based enterprise content management platform used across finance, healthcare, government, and retail. Its pre-2017 deployment guides published a sample machineKey that many production multi-instance deployments copied verbatim. Because that key is now public, any attacker can forge valid ViewState payloads the server accepts as legitimate, triggering remote code execution upon deserialization. CISA rated this Critical (CVSS 9.0) and confirmed active exploitation dating back to December 2024.
How CVE-2025-53690 is exploited
CVE-2025-53690 is a deserialization of untrusted data vulnerability classified under CWE-502, carrying a CVSS 9.0 (Critical) score. The full vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H:
- AV:N means the attack is delivered over the network.
- AC:H reflects the prerequisite of knowing the machineKey.
- PR:N/UI:N means no privileges or user interaction are needed.
- S:C means impact can extend beyond the vulnerable component.
- C:H/I:H/A:H means full confidentiality, integrity, and availability impact.
This is a ViewState deserialization flaw: Sitecore's pre-2017 deployment guides published a sample ASP.NET machineKey that many production deployments (particularly Sitecore XP 9.0 and Active Directory module 1.4 and earlier) copied verbatim. Because that key is now public, any attacker can use it to sign malicious ViewState payloads that the server accepts as legitimate. Attackers craft malicious serialized .NET objects using tools like ysoserial.net and deliver them via HTTP POST to exposed endpoints, triggering code execution when Sitecore deserializes the tampered ViewState. Mandiant identified /sitecore/blocked.aspx (a normally innocuous license-check page) as the primary attack endpoint, with /sitecore/shell/ClientBin/Reporting/Report.ashx observed in secondary exploitation.
When the Sitecore application deserializes these objects, it executes attacker-controlled code under the application pool identity. That grants full remote code execution, the ability to plant persistent backdoors, and a foothold for lateral movement within the enterprise network. Similar vulnerabilities in Sitecore have previously targeted HTTP headers or parameters that accept serialized objects, such as the ThumbnailsAccessToken header (see CVE-2025-27218).
The attack chain runs:
- Reconnaissance to identify Sitecore installations and vulnerable endpoints
- Crafting malicious serialized .NET objects with embedded payloads using
ysoserial.net - Delivering the payload via HTTP POST to the vulnerable endpoint (primarily
/sitecore/blocked.aspx) - Triggering deserialization and remote code execution under the IIS worker process (
w3wp) context - Creating local administrator accounts, dumping SAM/SYSTEM hives for credential extraction, and activating RDP for lateral movement
Indicator Type | Value / Pattern | Notes |
|---|---|---|
Attack endpoint (primary) |
| Primary exploit delivery path; POST requests with large ViewState bodies are suspicious |
Attack endpoint (secondary) |
| Secondary exploitation path observed in Mandiant's investigation |
Process anomaly |
| IIS worker spawning shells is a reliable RCE execution indicator |
File staging | EARTHWORM, DWAgent, or SharpHound binaries in web-accessible directories | Post-exploitation tools staged in the public web root after initial access |
Credential harvesting | SAM / SYSTEM hive access from | Indicates attacker is extracting local credentials for lateral movement |
Privilege escalation | Unexpected local administrator account creation | Commonly created immediately after RCE to gain persistence |
C2 traffic | Outbound encrypted tunnels originating from the web server | EARTHWORM creates encrypted C2 tunnels; look for unusual outbound connections from IIS hosts |
- Sitecore Experience Manager (XM): all versions in multi-instance deployments
- Sitecore Experience Platform (XP): all versions in multi-instance deployments
- Sitecore Experience Commerce (XC): all versions in multi-instance deployments
- Sitecore Managed Cloud
Per the official Sitecore security bulletin (SC2025-005), this vulnerability may impact all versions of XM, XP, and XC topologies deployed in multi-instance mode, beyond versions through 9.0. Single-instance deployments are not affected. CISA confirmed active exploitation and ordered immediate patching.
All configurations of these versions are vulnerable if they process serialized data from untrusted sources.
Sitecore deserialization vulnerability history
Sitecore has experienced multiple critical deserialization vulnerabilities in recent years, including:
CVE ID | Year | Attack Vector | KEV Listed |
|---|---|---|---|
CVE-2019-9874 | 2019 | HTTP header deserialization | Yes |
CVE-2019-9875 | 2019 | HTTP header deserialization | Yes |
CVE-2025-27218 | 2025 | ThumbnailsAccessToken header deserialization | No |
CVE-2025-53690 | 2025 | ViewState deserialization via known machineKey | Yes |
CVE-2025-53691, CVE-2025-53693, CVE-2025-53694 | 2025 | Additional deserialization disclosures | No |
CVE-2025-53690 remediation and compliance status
CVE-2025-53690 remains directly relevant nine months after its initial disclosure. Follow the steps below to close the exposure.
- Confirm whether your Sitecore deployment is multi-instance (XM, XP, XC, or Managed Cloud). Single-instance deployments are not affected.
- Apply Sitecore security bulletin SC2025-005 per the official KB article.
- Rotate the ASP.NET
machineKeyinweb.configto a newly generated cryptographically random value. Do not reuse the sample key from pre-2017 deployment guides. - If immediate patching is not possible, remove the affected Sitecore instance from public internet access at the WAF or network perimeter. This flips the BOD 26-04 "Asset Exposure" variable and pauses the three-day remediation clock while the full patch is staged.
- Verify the fix by confirming the new
machineKeyis unique and does not match the published sample value. - Document any compensating controls applied if the full patch has not yet been deployed.
The compliance stakes got higher on June 10, 2026, when CISA issued BOD 26-04, "Ranking Security Updates Based on Risk." It replaces CVSS-based scoring with a four-factor exploitability model for federal civilian agencies. Under BOD 26-04, a KEV-listed vulnerability like CVE-2025-53690 that grants total control over an internet-facing asset must be remediated, or have documented compensating controls applied, within three calendar days.
For federal agencies and critical-infrastructure operators still running unpatched Sitecore multi-instance deployments, this is a binding deadline, not a best-practice recommendation. CISA's rationale is explicit: AI-accelerated attack tooling has collapsed the disclosure-to-exploit window from weeks to hours, and the old CVSS-only queue cannot keep pace. Although BOD 26-04 formally binds only federal civilian agencies, CISA's previous KEV catalog (BOD 22-01) became a de facto standard across private-sector security programs, and security leaders should expect BOD 26-04 to follow suit with auditors and cyber insurers.
How ZeroPath detects Sitecore deserialization vulnerabilities
CVE-2025-53690 spent months in active exploitation before it surfaced in CISA's KEV catalog. The root cause, a publicly known machineKey that allowed forged ViewState deserialization, was present in production Sitecore deployments the entire time. Pattern-matching scanners did not flag it, because the deserialization call itself is not the problem; the problem is that attacker-controlled input reaches it without validation. A scanner that checks syntax without tracing the data flow from source to sink has no way to distinguish safe deserialization from exploitable deserialization. That detection gap is the structural failure CVE-2025-53690 exposes.
ZeroPath detects insecure deserialization vulnerabilities (CWE-502) by tracing data flow from attacker-controlled input to the deserialization sink. Unlike tools built on third-party rule or policy engines that pattern-match syntax, ZeroPath is custom-built on LLMs that understand overall code semantics. It reasons about what the code does, not whether it matches a known pattern. That trace is mandatory. When ZeroPath cannot confirm the path is reachable and exploitable, the finding is not recorded. With CVE-2025-53690, the attacker controls the ViewState payload and the server deserializes it without validation. Source-to-sink confirmation is the difference between a verified RCE finding and a noise alert a developer closes without reading.
Every confirmed finding ships with three artifacts: a source-to-sink data flow trace showing exactly how attacker input reaches the vulnerable call, a step-by-step attack path from prerequisites through impact, and an AI-generated fix patch the developer can approve from the dashboard, with ZeroPath opening a pull request that applies the fix to a new branch and includes a full description of the vulnerability, root cause, and implementation change. A secondary AI validation pass then reviews every true positive before ZeroPath records it. That pass filters out non-exploitable results and corrects inaccurate details. Teams get a verified, actionable queue, not a backlog of theoretical candidates to triage manually. Per ZeroPath's internal data, that process produces over 75% fewer false positives than traditional tools.
In practice, this matters most at the PR stage. ZeroPath's PR scans complete in under one minute across SAST, SCA, secrets, and IaC running in parallel. An insecure deserialization issue introduced in a code change gets flagged before it reaches the main branch, not weeks later in a penetration test or after a CISA KEV listing. For .NET applications using Sitecore or similar frameworks, ZeroPath's SAST coverage includes the full insecure deserialization category. For CVE-2025-53690 in particular, detection surfaces the exposure; complete remediation requires both applying SC2025-005 and rotating the exposed machineKey to a cryptographically random value, because the static key from the pre-2017 deployment guide is the root cause. Findings are application-aware and tied to the specific service and module where the vulnerable call occurs.
Fix verification closes the loop. When a fix PR merges, ZeroPath re-runs the analysis on the merged code and marks the issue as resolved only if the vulnerability is confirmed to be gone. If it persists, the issue remains open, and the next full scan automatically re-detects it. That is the structural difference between a finding that drops off the queue because someone closed a ticket and one that drops off because the code was confirmed fixed.
For teams managing BOD 26-04 deadlines, audit cycles, or cyber insurance renewals, ZeroPath maps every finding to its corresponding controls across SOC 2 and PCI DSS 4.0. That mapping updates with each scan. The fix verification step feeds directly into the audit trail: ZeroPath records scan execution, finding lifecycle, and post-merge remediation confirmation in an immutable log. When an auditor asks for documented proof that CVE-2025-53690 was detected, patched, and verified, ZeroPath produces a dated record linking the finding, the fix PR, and the verification result. That is what a defensible remediation record looks like under the scrutiny of BOD 26-04.
Final thoughts on CVE-2025-53690
CVE-2025-53690 is a case study in how legacy configuration choices can outlast the environments they were made in. A machineKey published in a 2017 Sitecore deployment guide is now part of the live attack surface in production systems worldwide. Applying SC2025-005 and rotating the machineKey is the direct fix for affected deployments. For security teams looking to catch insecure deserialization before it reaches production, an AI-native application security platform that validates exploitability instead of matching syntax patterns is the practical path forward. Book a demo to see how ZeroPath finds this class of vulnerability in your codebase.
FAQ
How does CVE-2025-53690 achieve remote code execution through a single HTTP request?
Attackers forge valid ViewState payloads using the publicly known Sitecore machineKey from pre-2017 deployment guides, then craft malicious serialized .NET objects with ysoserial.net and POST them to exposed endpoints like /sitecore/blocked.aspx. Because the server accepts the forged payload as legitimate, deserialization triggers code execution under the IIS worker process identity without requiring any authentication.
Which Sitecore deployments are vulnerable to CVE-2025-53690, and are single-instance setups affected?
Only multi-instance deployments of Sitecore XM, XP, and XC are affected across all versions; single-instance deployments are not vulnerable. Sitecore Managed Cloud is also in scope, per the official security bulletin SC2025-005.
What is the fastest way to reduce exposure to CVE-2025-53690 if you cannot patch immediately?
Removing affected Sitecore instances from public internet access flips the "Asset Exposure" variable under CISA's BOD 26-04 four-factor model, which relaxes the three-day remediation clock while the full patch is staged. This can be enforced at the WAF or network perimeter in minutes; applying SC2025-005 and rotating the machineKey remains the complete fix.
How does ZeroPath detect insecure deserialization vulnerabilities like CVE-2025-53690 differently from traditional SAST tools?
ZeroPath traces data flow from attacker-controlled input through to the deserialization sink, confirming the path is reachable and exploitable before recording a finding, instead of flagging every deserialization call in the codebase. Each confirmed finding includes a mandatory source-to-sink trace and step-by-step attack path, and ZeroPath auto-generates a fix patch alongside it, so teams get a verified, actionable result instead of a candidate list to triage manually.
Should I be concerned about CVE-2025-53690 if my organization is not a federal agency bound by BOD 26-04?
Yes. CISA's previous KEV catalog under BOD 22-01 became a de facto standard across private-sector security programs, and security leaders should expect BOD 26-04, with its three-day remediation deadline for KEV-listed internet-facing vulnerabilities, to follow the same path with auditors and cyber insurers. CVE-2025-53690 has been actively exploited since at least December 2024, making patching and machineKey rotation urgent regardless of regulatory jurisdiction.
