CVE-2025-53691: 
Sitecore Experience Platform (XP) vulnerability analysis and mitigation

CVE-2025-53691 is a Deserialization of Untrusted Data vulnerability (CWE-502) in Sitecore Experience Manager (XM) and Experience Platform (XP) that enables authenticated remote code execution. It affects XM and XP versions 9.0 through 9.3 and 10.0 through 10.4, as well as Experience Commerce (9.0–10.4) and Managed Cloud. The vulnerability was published on September 3, 2025, with patches released by Sitecore in June–July 2025. It carries a CVSS v3.1 base score of 8.8 (High) (watchTowr Labs, Sitecore KB).

The vulnerability (tracked internally as WT-2025-0019) stems from insecure deserialization of untrusted data within Sitecore's processing pipeline, classified as CWE-502. It was discovered by Piotr Bazydlo (@chudyPB) of watchTowr Labs as part of a broader exploit chain that also includes a pre-authentication HTML cache poisoning vulnerability (CVE-2025-53693). The attack chain works by first exploiting the XamlPageHandlerFactory HTTP handler (reachable pre-auth via /-/xaml/) to poison the HTML cache, then leveraging the deserialization flaw post-authentication to achieve RCE. Exploitation requires low-level authenticated access but no user interaction, and the attack is conducted entirely over the network. A public PoC is available on GitHub and a detailed technical write-up was published by watchTowr Labs (watchTowr Labs, GitHub PoC).

Successful exploitation grants an authenticated attacker with low privileges complete control over the affected Sitecore server, resulting in high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary code remotely, access or exfiltrate sensitive data, modify or destroy system files, and disrupt service availability. Given that Sitecore is widely deployed in enterprise environments — with at least 22,000 internet-facing instances identified — the blast radius is significant, and compromised instances could serve as pivot points for lateral movement within enterprise networks (watchTowr Labs).

Public proof-of-concept exploit code is available both in a detailed watchTowr Labs technical write-up and on GitHub (watchTowr Labs, GitHub PoC). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The vulnerability is detected by Qualys (detection ID 385766) and has been covered by Cloudflare's emergency WAF release on September 4, 2025. The EPSS score is approximately 0.654%, and the vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Sitecore XM/XP instances (versions 9.0–9.3 or 10.0–10.4) using tools like Shodan or Censys. Confirm the presence of the XAML handler by sending a GET request to /-/xaml/Sitecore.Shell.Xaml.WebControl.
2. Cache Key Enumeration (Optional Pre-Auth): If the ItemService API is exposed (test with GET /sitecore/api/ssc/item), query cacheable layouts via /sitecore/api/ssc/item/search?term=layouts to retrieve item paths, caching settings (e.g., Cacheable=1, VaryByLogin, VaryByDevice), and enumerate device names to reconstruct valid cache keys.
3. HTML Cache Poisoning (Pre-Auth, CVE-2025-53693): Send a crafted POST request to /-/xaml/Sitecore.Shell.Xaml.WebControl with __PARAMETERS=AddToCache("<cacheKey>","<malicious_html>") and __SOURCE=ctl00_ctl00_ctl05_ctl03 to overwrite cached HTML content. This exploits the AjaxScriptManager reflection mechanism to invoke AddToCache on the GlobalHeader XmlControl.
4. Authentication: Obtain low-privilege credentials (e.g., via the poisoned cache delivering a credential-harvesting page, or through other means such as the hardcoded credentials vulnerability CVE-2025-34509).
5. Post-Auth RCE via Deserialization (CVE-2025-53691): As an authenticated user, send a crafted request containing a malicious serialized payload to the vulnerable deserialization endpoint. The server deserializes the untrusted data without validation, triggering arbitrary code execution.
6. Establish Persistence: Use the achieved RCE to deploy a web shell, create a backdoor account, or establish a reverse shell for persistent access and lateral movement (watchTowr Labs, GitHub PoC).

• Network: Unusual POST requests to /-/xaml/Sitecore.Shell.Xaml.WebControl containing __PARAMETERS=AddToCache(...) and __SOURCE=ctl00_ctl00_ctl05_ctl03 in the body; unexpected GET requests to /sitecore/api/ssc/item/search from external IPs; outbound connections from the Sitecore server to unknown external hosts.
• Logs: IIS/web server access logs showing repeated requests to /-/xaml/ endpoints with POST bodies containing __ISEVENT=1; access log entries for /sitecore/api/ssc/item from non-internal IP addresses; Sitecore application logs showing deserialization errors or unexpected object instantiation.
• File System: Unexpected web shells (.aspx, .ashx) in the Sitecore web root or layouts directory; new or modified files in the Sitecore installation directory created by the IIS application pool identity.
• Process: Unusual child processes spawned by the IIS worker process (w3wp.exe), such as cmd.exe, powershell.exe, net.exe, or network utilities like curl or certutil.
• Application: Unexpected or defaced HTML content served from cached Sitecore pages; cache entries with anomalous HTML content not matching legitimate site content (watchTowr Labs).

Sitecore released patches in June and July 2025 for affected versions of Experience Manager (XM), Experience Platform (XP), Experience Commerce, and Managed Cloud. Administrators should apply the patches detailed in the Sitecore Knowledge Base article KB1003667 immediately. As interim mitigations: restrict or disable access to the /-/xaml/ HTTP handler and the ItemService API (/sitecore/api/ssc/item) from untrusted networks; implement network segmentation to limit external access to Sitecore management interfaces; apply the principle of least privilege to Sitecore user accounts; and monitor for suspicious deserialization activity and anomalous requests to XAML endpoints (Sitecore KB, watchTowr Labs).

The vulnerability received significant media coverage following the watchTowr Labs disclosure on August 29, 2025, with The Hacker News, GBHackers, CyberSecurityNews, and CyberPress all reporting on the exploit chain. Cloudflare issued an emergency WAF rule update on September 4, 2025 to provide virtual patching for exposed instances (Cloudflare). The Belgian Centre for Cybersecurity (CCB) issued an advisory warning about the vulnerability chain. Community discussion on Reddit (r/SecOpsDaily) and Mastodon (infosec.exchange) highlighted the severity of the pre-auth to RCE chain. The ZeroPath blog also published a summary of the related deserialization issues in Sitecore (The Hacker News).