CVE-2025-53691: Sitecore Experience Remote Code Execution through Insecure Deserialization

Q: What is the severity of CVE-2025-53691?

CVE-2025-53691 has a high severity rating due to its potential to allow remote code execution.

Q: How do I fix CVE-2025-53691?

To mitigate CVE-2025-53691, it is recommended to upgrade Sitecore Experience Manager or Experience Platform to the latest fixed version.

Q: What versions are affected by CVE-2025-53691?

CVE-2025-53691 affects Sitecore Experience Manager versions 9.0 to 9.3 and 10.0 to 10.4, as well as Experience Platform versions 9.0 to 9.3 and 10.0 to 10.4.

Q: What kind of vulnerability is CVE-2025-53691?

CVE-2025-53691 is a deserialization of untrusted data vulnerability, which can lead to remote code execution.

Q: Can CVE-2025-53691 be exploited remotely?

Yes, CVE-2025-53691 can be exploited remotely due to the nature of its vulnerability.

Published Sep 3, 2025

Updated

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Affected Software

7 affected components

Sitecore Experience Manager>=9.0<=9.3, >=10.0<=10.4

Sitecore Experience Platform>=9.0<=9.3, >=10.0<=10.4

Sitecore Experience Commerce>=9.0<=10.4

Sitecore Experience Manager>=9.0<=10.4

Sitecore Experience Platform>=9.0<10.4

Sitecore Experience Platform=10.4

Sitecore Managed Cloud

Event History

Sep 3, 2025

CVE Published

via MITRE·12:36 PM

Data Sourced

via MITRE·12:36 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-53691?

CVE-2025-53691 has a high severity rating due to its potential to allow remote code execution.

How do I fix CVE-2025-53691?

To mitigate CVE-2025-53691, it is recommended to upgrade Sitecore Experience Manager or Experience Platform to the latest fixed version.

What versions are affected by CVE-2025-53691?

CVE-2025-53691 affects Sitecore Experience Manager versions 9.0 to 9.3 and 10.0 to 10.4, as well as Experience Platform versions 9.0 to 9.3 and 10.0 to 10.4.

What kind of vulnerability is CVE-2025-53691?

CVE-2025-53691 is a deserialization of untrusted data vulnerability, which can lead to remote code execution.

Can CVE-2025-53691 be exploited remotely?