CVE-2025-53694: 
Sitecore Experience Platform (XP) vulnerability analysis and mitigation

CVE-2025-53694 is an information disclosure vulnerability (CWE-200) in Sitecore's ItemService API, affecting Sitecore Experience Manager (XM) and Experience Platform (XP) versions 9.2 through 10.4. Discovered by watchTowr Labs researcher Piotr Bazydlo and disclosed on September 3, 2025, the flaw allows unauthenticated remote attackers to enumerate sensitive Sitecore item data — including cache keys, layout paths, and caching configuration — when the ItemService API is exposed to the internet. It carries a CVSS v3.1 base score of 7.5 (High), reflecting network-accessible exploitation with no authentication or user interaction required (watchTowr Labs, Sitecore KB).

The root cause (CWE-200) lies in the Sitecore ItemService API (/sitecore/api/ssc/item), which — when misconfigured to allow remote or anonymous access — exposes detailed internal item metadata to unauthenticated callers. An attacker can query the search endpoint to retrieve item paths, caching flags (Cacheable, VaryByLogin, VaryByDevice, etc.), and device names, which together allow precise reconstruction of HTML cache keys used by Sitecore's caching subsystem. This information disclosure is a critical enabler for chaining with CVE-2025-53693 (pre-auth HTML cache poisoning via the AddToCache reflection path in the XAML handler) and ultimately CVE-2025-53691 (post-auth RCE via insecure deserialization), forming a complete unauthenticated-to-RCE exploit chain. The vulnerability was identified in Sitecore Experience Platform 10.4.1 rev. 011628 (watchTowr Labs).

Successful exploitation of CVE-2025-53694 alone results in high confidentiality impact — attackers can enumerate all Sitecore item metadata, layout paths, caching configurations, and device names without any credentials. More critically, when chained with CVE-2025-53693 and CVE-2025-53691, this information disclosure enables a fully unauthenticated attacker to poison the HTML cache with arbitrary content and ultimately achieve remote code execution, leading to complete compromise of the Sitecore server. With an estimated 22,000 Sitecore instances exposed on the internet, the potential scope of impact across enterprise organizations is significant (watchTowr Labs, The Hacker News).

Public proof-of-concept exploit code is available from watchTowr Labs and on GitHub (watchTowr Labs, GitHub PoC). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and CVE-2025-53694 is not listed in the CISA KEV catalog. The EPSS score is approximately 0.031% (0.000310), reflecting low but non-zero probability of exploitation in the near term. Exploitation requires the ItemService API to be exposed to the internet or accessible without authentication — a misconfiguration documented by Sitecore itself and observed in real-world deployments (watchTowr Labs).

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing Sitecore Experience Platform or Experience Manager instances (versions 9.2–10.4). Look for the /sitecore/api/ssc/item endpoint.
2. Check ItemService API exposure: Send GET /sitecore/api/ssc/item to the target. A 404 Not Found response with the message The item "" was not found indicates the API is exposed without authentication. A 403 Forbidden means it is protected.
3. Enumerate cacheable layouts: Query the search endpoint to identify cacheable Sitecore items:

   GET /sitecore/api/ssc/item/search?term=layouts&fields=&page=0&pagesize=100

   Parse the response for items with "Cacheable":"1" and record their Path, VaryByLogin, VaryByDevice, VaryByQueryString, and other cache variation flags.
4. Enumerate device names: Retrieve all device names to complete cache key reconstruction:

   GET /sitecore/api/ssc/item/search?term=_templatename:Device&fields=ItemName&page=0&pagesize=100

5. Reconstruct cache keys: Using the item path, language, and VaryBy flags, construct the exact cache key format, e.g., /layouts/Sample Sublayout.ascx_#lang:EN_#dev:Default_#login:False_#index.
6. Poison the HTML cache (CVE-2025-53693): Send a crafted POST request to the XAML handler to overwrite the identified cache entry with attacker-controlled HTML:

   POST /-/xaml/Sitecore.Shell.Xaml.WebControl HTTP/2
   Content-Type: application/x-www-form-urlencoded
   __PARAMETERS=AddToCache("/layouts/Sample+Sublayout.ascx_%23lang%3aEN_%23login%3aFalse_%23qs%3a_%23index","<malicious_html>")&__SOURCE=ctl00_ctl00_ctl05_ctl03&__ISEVENT=1

7. Chain to RCE (CVE-2025-53691): Leverage the poisoned cache or obtained credentials/session to trigger the insecure deserialization vulnerability (CVE-2025-53691) for full remote code execution on the server (watchTowr Labs, GitHub PoC).

• Network: Unauthenticated HTTP GET requests to /sitecore/api/ssc/item/search with parameters like term=layouts or term=_templatename:Device; repeated requests to /-/xaml/Sitecore.Shell.Xaml.WebControl with POST bodies containing __PARAMETERS=AddToCache and __ISEVENT=1.
• Logs: Web server access logs showing GET /sitecore/api/ssc/item returning 404 from external IP addresses; POST requests to /-/xaml/Sitecore.Shell.Xaml.WebControl with __PARAMETERS containing AddToCache from unauthenticated sessions.
• File System: Unexpected or modified cached HTML content in Sitecore's HTML cache store; web shells or scripts placed in the Sitecore installation directory following RCE exploitation.
• Process: Unusual child processes spawned by the Sitecore IIS worker process (e.g., cmd.exe, powershell.exe) if the chain progresses to RCE via CVE-2025-53691 (watchTowr Labs).

Sitecore released patches in June and July 2025; organizations should apply the updates referenced in Sitecore KB article KB1003734 immediately. As a workaround, restrict or disable external access to the ItemService API (/sitecore/api/ssc/item) by ensuring it is bound only to loopback or requires authentication — the default configuration blocks remote access with a 403, so review any configuration changes that may have exposed it. Additionally, implement network segmentation to limit internet exposure of Sitecore management interfaces, and audit web.config and Sitecore configuration files for any settings that enable anonymous or remote ItemService access (Sitecore KB, watchTowr Labs).

The watchTowr Labs blog post detailing the full exploit chain (CVE-2025-53694 chained with CVE-2025-53693 and CVE-2025-53691) received significant coverage from The Hacker News, CyberSecurityNews, and multiple security aggregators shortly after publication in late August 2025 (The Hacker News). Belgium's Centre for Cybersecurity (CCB) issued a warning about the vulnerability chain, highlighting the risk of full system compromise (CCB Advisory). Check Point also published a defensive advisory (CPAI-2025-1005), and Cloudflare added WAF rules in its September 15, 2025 release to detect exploitation attempts. Community discussion on Reddit and Mastodon reflected concern about the large number of exposed Sitecore instances and the availability of public PoC code.