CVE-2025-53690: 
Sitecore Experience Platform (XP) vulnerability analysis and mitigation

CVE-2025-53690 is a critical deserialization of untrusted data vulnerability (CWE-502) affecting Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud products through version 9.0. The flaw involves the use of publicly known default or sample ASP.NET machine keys, enabling unauthenticated remote attackers to achieve code injection and remote code execution. It was publicly disclosed on September 3, 2025, with Mandiant/Google Threat Intelligence and Sitecore issuing coordinated advisories. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) (Feedly, CISA KEV).

The root cause is improper handling of ASP.NET ViewState deserialization when Sitecore deployments use publicly known or sample machine keys — keys that were distributed in documentation, code samples, or default configurations and never rotated by administrators. ASP.NET uses machine keys to sign and encrypt ViewState; when these keys are known to an attacker, they can craft a malicious serialized payload that the server will deserialize and execute without authentication (CWE-502). The attack vector is network-based with high complexity (AC:H), requiring no privileges or user interaction, and has a changed scope due to the potential for cross-system impact. Mandiant's investigation revealed attackers leveraged publicly available sample keys — some over 8 years old — to forge valid ViewState tokens and deliver arbitrary .NET code to the server (Google Mandiant Blog, Sitecore KB). Public PoC code is available on GitHub (GitHub PoC).

Successful exploitation grants an unauthenticated remote attacker full code execution on the Sitecore server, resulting in complete compromise of confidentiality, integrity, and availability. Attackers have been observed deploying backdoors, the WeepSteel reconnaissance malware, SharpHound (Active Directory enumeration), and the Earthworm tunneling tool, enabling lateral movement into internal networks and data exfiltration (BleepingComputer, SOCRadar). The vulnerability is particularly dangerous because Sitecore is widely deployed by enterprises and government agencies, and the affected scope includes managed cloud instances, broadening the attack surface beyond on-premises deployments (CISA KEV).

CVE-2025-53690 was exploited as a zero-day before public disclosure and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 4, 2025, with a federal agency remediation deadline of September 25, 2025 (CISA KEV). Multiple public PoC exploits exist, including repositories on GitHub (GitHub PoC). The China-linked threat actor UAT-8837 has been attributed to exploitation campaigns targeting North American critical infrastructure, deploying tools including WeepSteel, SharpHound, and Earthworm (Cisco Talos, BleepingComputer). The EPSS score is approximately 0.234 (23.4%), reflecting significant real-world exploitation probability (Feedly).

1. Reconnaissance: Identify internet-facing Sitecore XM/XP/XC deployments (version ≤9.0) using tools like Shodan, Censys, or web crawlers searching for Sitecore-specific response headers or login pages.
2. Obtain known machine keys: Retrieve publicly documented sample or default ASP.NET machine keys from Sitecore documentation, GitHub repositories, or published lists of known leaked keys — some dating back 8+ years.
3. Craft malicious ViewState payload: Use tools such as ysoserial.net to generate a malicious serialized .NET object (e.g., a command execution gadget chain), then sign and encrypt it using the known machine key to produce a valid-looking ViewState token.
4. Submit forged ViewState: Send an HTTP POST request to a Sitecore page that processes ViewState (e.g., any standard ASP.NET WebForms endpoint), embedding the crafted ViewState in the __VIEWSTATE parameter.
5. Achieve remote code execution: The server deserializes the malicious payload without authentication, executing arbitrary commands as the IIS application pool identity (typically NETWORK SERVICE or a dedicated service account).
6. Deploy post-exploitation tooling: Drop backdoors, WeepSteel malware for reconnaissance, SharpHound for Active Directory enumeration, or Earthworm for network tunneling to establish persistent access and enable lateral movement (Google Mandiant Blog, Cisco Talos, BleepingComputer).

• Network: Unusual outbound connections from the Sitecore/IIS server to unknown external IPs; use of tunneling tools (Earthworm) creating persistent reverse tunnels; anomalous SMB or LDAP traffic indicative of lateral movement.
• Web/Application Logs: HTTP POST requests to Sitecore WebForms endpoints with abnormally large or encoded __VIEWSTATE parameters; requests originating from unexpected geographic locations or IPs with no prior history.
• File System: Presence of unexpected web shells (.aspx, .ashx) in the Sitecore web root or temp directories; WeepSteel malware artifacts; SharpHound output files (e.g., *_BloodHound.zip, *.json AD enumeration files); Earthworm binary (ew.exe or similar) in unusual directories.
• Process: Unusual child processes spawned by w3wp.exe (IIS worker process), such as cmd.exe, powershell.exe, net.exe, or unknown executables; SharpHound.exe or ew.exe execution under IIS service accounts.
• Registry/Persistence: New scheduled tasks or services created by the IIS application pool account; modifications to startup registry keys by non-administrative processes.
• Event Logs: Windows Security Event ID 4688 (process creation) showing w3wp.exe spawning command-line tools; IIS logs showing 200 responses to POST requests with oversized ViewState values (Google Mandiant Blog, Cisco Talos, BleepingComputer).

Sitecore has released patches and guidance via KB1003865; organizations should apply vendor mitigations immediately per the CISA KEV directive (federal agencies had a due date of September 25, 2025) (Sitecore KB, CISA KEV). The primary remediation is to rotate all ASP.NET machine keys to unique, cryptographically random values — never use default, sample, or publicly documented keys. Additional recommended steps include: (1) implement network segmentation to restrict external access to Sitecore instances; (2) deploy Web Application Firewall (WAF) rules to detect and block oversized or anomalous ViewState payloads; (3) monitor for suspicious deserialization activity and unusual child processes from IIS worker processes; (4) if patching is not immediately possible, consider disabling unnecessary serialization endpoints or restricting access to Sitecore admin interfaces (Feedly Executive Summary).

Google Mandiant published the initial technical disclosure, attributing active exploitation to unknown threat actors using publicly available sample machine keys, which generated significant media coverage across BleepingComputer, The Register, SecurityWeek, and CSOOnline (BleepingComputer, The Register). CISA issued an urgent alert and added the CVE to the KEV catalog the same day as public disclosure, ordering federal agencies to patch within 21 days (CISA KEV). In January 2026, Cisco Talos published a detailed report attributing ongoing exploitation to China-linked APT UAT-8837, targeting North American critical infrastructure, which renewed widespread industry attention and commentary (Cisco Talos). Security researchers on social media (Mastodon, Twitter/X, Bluesky) highlighted the irony of 8-year-old sample keys enabling critical infrastructure compromise, and multiple national CERTs (Belgium CCB, Ireland NCSC, Austria CERT.at) issued independent advisories urging immediate patching.