Sitecore Products ViewState Deserialization Vulnerability

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2025-09-03 Published
2. 2025-09-04 Added to CISA KEV
3. 2025-09-05 CISA SSVC: exploitation active
4. 2025-09-25 CISA patch deadline

Added

14 mo ago (2025-09-04)

Patch by

2025-09-25 (13 mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

Sitecore, Multiple Products

CISA name

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

14 mo ago (2025-09-05)

60.71% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).

• cloud.google.com https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability referenced PoC, tagged "exploit" by a source, unverified

• Sitecore Experience Manager (XM)
• Sitecore Experience Platform (XP)

Weakness

• CWE-502 Deserialization of Untrusted Data

• cloud.google.com /blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability

  exploit, third-party-advisory

• support.sitecore.com /kb?id=kb_article_view&sysparm_article=KB1003865

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690

  government-resource, us-government-resource

• CVE List CVE-2025-53690
• NVD CVE-2025-53690

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.