CVE-2025-53693: 
Sitecore Experience Platform (XP) vulnerability analysis and mitigation

CVE-2025-53693 is a pre-authentication HTML cache poisoning vulnerability discovered in Sitecore Experience Manager (XM) and Sitecore Experience Platform (XP). The vulnerability was discovered by watchTowr Labs and disclosed on June 16, 2025. It affects Sitecore Experience Manager (XM) versions 9.0 through 9.3 and 10.0 through 10.4, as well as Experience Platform (XP) versions 9.0 through 9.3 and 10.0 through 10.4. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical) (Wiz NVD).

The vulnerability stems from unsafe reflection in the XamlPageHandlerFactory component, specifically in how it handles the AjaxScriptManager control. The issue allows an attacker to abuse a restricted reflection path to call methods that can poison any HTML cache key through the Sitecore.Web.UI.WebControl.AddToCache method. The vulnerability can be triggered by sending specially crafted HTTP requests to the /-/xaml/Sitecore.Shell.Xaml.WebControl endpoint, allowing attackers to manipulate cached content (Watchtowr Labs).

The vulnerability allows unauthenticated attackers to perform HTML cache poisoning attacks against Sitecore instances. This can lead to the modification of cached content served to users, potentially enabling further attacks through malicious JavaScript injection. When chained with other vulnerabilities, it could lead to complete system compromise through remote code execution (Hacker News).

Patches for this vulnerability were released by Sitecore in June 2025. Organizations are strongly advised to update to the latest patched versions of Sitecore Experience Manager and Experience Platform. The vulnerability has been fixed in subsequent releases after the affected versions (Hacker News).

The security community has expressed significant concern about this vulnerability, particularly due to its critical severity rating and the widespread use of Sitecore in enterprise environments. Research indicates that at least 22,000 Sitecore instances could be potentially affected (Watchtowr Labs).