CVE-2025-53690

What it actually does

CVE-2025-53690 is a deserialization of untrusted data vulnerability in Sitecore Experience Manager and Sitecore Experience Platform versions through 9.0. A vulnerable Sitecore application can process attacker-supplied serialized data and reconstruct it in a way that allows code injection. In practical terms, successful exploitation can lead to arbitrary code execution in the context of the Sitecore web application process, typically the IIS worker process. Depending on application permissions, this can allow command execution, web shell deployment, credential theft, persistence, lateral movement, and full compromise of the Sitecore server.

Why it matters to the business

This is a high-severity, actively exploited vulnerability affecting internet-facing content management infrastructure. Because Sitecore often supports public websites, marketing portals, customer-facing services, and integrations with internal systems, compromise can result in website defacement, service disruption, data theft, credential exposure, malware deployment, and a foothold into the broader enterprise network. The vulnerability is listed in CISA KEV with a remediation due date of 2025-09-25, so organizations still running affected versions may face elevated operational, compliance, and incident-response risk. EPSS is elevated at approximately 31%, reinforcing that exploitation is plausible at scale, not merely theoretical.

How an attack unfolds

An attacker first identifies a public Sitecore XM or XP instance running a vulnerable version through 9.0. They then locate an endpoint that accepts serialized application state, commonly associated with ASP.NET/Sitecore request processing such as ViewState-style parameters. The attacker submits a crafted serialized payload designed to trigger unsafe deserialization on the server. When the vulnerable application deserializes the payload, attacker-controlled code paths are invoked, allowing command execution under the Sitecore application pool identity. From there, the attacker may run discovery commands, write an ASPX web shell into the web root, download tooling, dump credentials or configuration secrets, and use the compromised server as a pivot point. Public reporting and KEV status indicate active in-the-wild exploitation, including activity tracked around Sitecore ViewState deserialization and broader September 2025 exploitation campaigns affecting Sitecore and other internet-facing applications.

How to fix it

Upgrade affected Sitecore Experience Manager and Experience Platform deployments to a vendor-supported fixed release newer than the affected through-9.0 versions, or apply the relevant Sitecore security update or hotfix if provided for the deployed branch. Because no exact fixed versions were supplied, treat all XM/XP versions through 9.0 as vulnerable until confirmed otherwise by Sitecore advisory guidance. Prioritize internet-facing systems and systems integrated with identity, commerce, marketing automation, or customer data platforms. If immediate upgrade is not possible, restrict external access to Sitecore administrative and content-management endpoints, place vulnerable instances behind strong access controls or VPN, enforce WAF rules for suspicious serialized payloads, disable unnecessary endpoints, and harden ASP.NET ViewState protections. Rotate Sitecore machine keys, application secrets, database credentials, API keys, and service account passwords if exploitation is suspected, because deserialization exploitation can expose secrets or enable persistent access. Rebuild from known-good media if web shells, unknown binaries, or post-exploitation activity are found.

How to confirm the fix worked

Confirm the deployed Sitecore XM or XP version is no longer within the affected through-9.0 range and that the relevant Sitecore security update is installed. Validate from both application inventory and file/package metadata rather than relying only on banner information. From an external perspective, confirm that Sitecore administrative and content-authoring endpoints are not publicly reachable unless explicitly required and protected. Review IIS request handling to ensure suspicious serialized payloads are blocked or no longer trigger server-side errors. Run an authenticated vulnerability scan or vendor-supported health check after patching. Verify that application pool identities have least privilege and cannot write broadly across the web root. Check file integrity of the Sitecore web directory for unexpected ASPX, DLL, ZIP, EXE, PS1, or BAT files created around the suspected exposure window. If credentials were rotated, validate that old credentials no longer work and that dependent services have been updated safely.

Typical attack path

1. Scan the internet or known asset inventories for exposed Sitecore XM or XP instances.
2. Fingerprint the Sitecore version and confirm it is at or below the affected 9.0 release line.
3. Identify a request path or form workflow that accepts serialized state or ViewState-like data.
4. Send a crafted serialized payload that triggers unsafe deserialization and code injection.
5. Execute operating system commands through the Sitecore/IIS application context.
6. Establish persistence, commonly by writing an ASPX web shell or deploying remote management tooling.
7. Collect Sitecore configuration files, database connection strings, application secrets, and credentials.
8. Use the compromised server for lateral movement, data access, website manipulation, or additional malware deployment.

How to detect it

Review IIS access logs for unusual POST requests containing large or anomalous serialized parameters, especially requests including __VIEWSTATE, __VIEWSTATEGENERATOR, long Base64-like values, or repeated 500 responses followed by successful requests. Correlate suspicious web requests with Windows process creation logs, Sysmon Event ID 1, EDR telemetry, and Windows Security Event ID 4688 showing w3wp.exe spawning cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, or wget.exe. Examine Sitecore application logs for deserialization, ViewState, MAC validation, ObjectStateFormatter, LosFormatter, or unhandled serialization exceptions. Search the Sitecore web root, upload directories, temporary ASP.NET compilation directories, and writable media paths for recently created ASPX files, unexpected DLLs, or files with command-execution web shell patterns. Investigate outbound connections from the Sitecore server shortly after suspicious requests, especially to unknown IPs, paste sites, cloud file-sharing URLs, or command-and-control infrastructure. Because active exploitation has been associated with Sitecore ViewState deserialization campaigns, prioritize hunting around the publication and exploitation period and any time windows when vulnerable Sitecore systems were exposed to the internet. If compromise indicators are present, collect memory, IIS logs, Sitecore logs, web root file listings with timestamps, prefetch/amcache/shimcache artifacts, scheduled tasks, services, autoruns, and credential access telemetry.

• __VIEWSTATE
• __VIEWSTATEGENERATOR
• ObjectStateFormatter
• LosFormatter
• Validation of viewstate MAC failed
• The state information is invalid for this page and might be corrupted
• System.Web.UI.ViewStateException
• System.Runtime.Serialization.SerializationException
• ysoserial.net
• w3wp.exe cmd.exe
• w3wp.exe powershell.exe
• w3wp.exe cscript.exe
• w3wp.exe wscript.exe
• w3wp.exe mshta.exe
• w3wp.exe rundll32.exe
• w3wp.exe certutil.exe
• w3wp.exe bitsadmin.exe
• powershell -enc
• powershell -EncodedCommand
• cmd.exe /c
• /bin/sh -c
• App_Web_
• C:\inetpub\wwwroot\
• C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\
• C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\
• .aspx
• <%@ Page Language="C#"
• Request.Form["cmd"]
• Request.QueryString["cmd"]
• System.Diagnostics.Process.Start

What your security team should do

• Immediately inventory all Sitecore XM and XP deployments and identify any version through 9.0, prioritizing internet-facing systems.
• Patch or upgrade vulnerable Sitecore systems on an emergency basis; the CISA KEV due date was 2025-09-25 and active exploitation has been reported.
• If patching cannot be completed immediately, restrict access to Sitecore management and authoring endpoints using network controls, VPN, allowlisting, and WAF rules.
• Hunt for exploitation in IIS, Sitecore, Windows Security, Sysmon, EDR, and web server file-system telemetry from at least the public exploitation window onward.
• Search for suspicious child processes spawned by IIS worker processes, especially command shells, PowerShell, script interpreters, archive tools, and download utilities.
• Inspect Sitecore web roots and upload directories for newly created ASPX web shells, unexpected DLLs, renamed binaries, and recently modified configuration files.
• Rotate Sitecore machine keys, database credentials, service account passwords, API tokens, and integration secrets if compromise is suspected or confirmed.
• Review application pool identity privileges and remove unnecessary local administrator, file-write, and network access permissions.
• Add detections for ViewState/deserialization payload patterns and IIS worker process command execution.
• If evidence of exploitation is found, treat the Sitecore server as a likely initial access point and perform full incident response, including lateral movement and credential-access investigation.