sitecore Experience Manager vulnerabilities

Latest sitecore Experience Manager CVEs

Newest publication first

1. CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability

   Published 2025-09-03

   Critical·CVSS 9.0 EPSS 60.7% CISA KEV added 2025-09-04 Exploited in the wild

   Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

2. CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization

   Published 2025-09-03

   High·CVSS 8.8 EPSS 1.6%

   Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 t...

3. CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections

   Published 2025-09-03

   Critical·CVSS 9.8 EPSS 20.3%

   Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from...

4. CVE-2025-53694 Information Disclosure in ItemServices API

   Published 2025-09-03

   High·CVSS 7.5 EPSS 6.9%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

5. CVE-2025-34511 Sitecore PowerShell Extension RCE via Unrestricted Upload

   Published 2025-06-17

   High·CVSS 8.8 EPSS 32.4% Framework module

   Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP request...

6. CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

   Published 2025-06-17

   High·CVSS 8.8 EPSS 26.5% Framework module

   Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a...

7. CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials

   Published 2025-06-17

   High·CVSS 7.5 EPSS 56.2%

   Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this acco...

8. CVE-2024-46938 An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can re...

   Published 2024-09-15

   High·CVSS 7.5 EPSS 46.8%

   An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

9. CVE-2023-35813 Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

   Published 2023-06-17

   Critical·CVSS 9.8 EPSS 86.7%

   Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

10. CVE-2023-33651 An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypas...

    Published 2023-06-06

    High·CVSS 7.5 EPSS 1.4%

    An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

11. CVE-2023-26262 An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content managem...

    Published 2023-03-14

    High·CVSS 7.2 EPSS 1.7%

    An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.