CVE-2025-53690Vulnerability
Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 28 days ago
CISA KEVAdded 4 Sep 2025
Fix due 25 Sep 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 25 Sep 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS60.6%
higher than 99% of CVEsFIRST EPSS, as of 24 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-02 - January 2026“Recently, the threat actor likely exploited CVE-2025-53690, a ViewState deserialisation zero-day vulnerability in SiteCore products.”
-
Top Cyber Threat Trends of 2025: Deepfakes, ClickFix & More“More recently, in September, Mandiant researchers revealed a ViewState deserialization zero day attack (CVE-2025-53690) that was impacting Sitecore deployments.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-21509, CVE-2026-1281, CVE-2025-8088, CVE-2025-64155, CVE-2026-20045, CVE-2025-30406
Thanks — we review every report.