PatchTheCVECVE-2025-53694: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manag
60
This week
HIGH 7.5REMOTEUPGRADEUPGRADEUPGRADE
CVE-2025-53694 is a high-severity flaw (CVSS 7.5) affecting experience commerce, experience manager, experience platform. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Why this priority
- High severity
- EPSS top 6%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 6.7% (top 6%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2025-09-03 |
| Last modified | 2026-10-18 |
Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
sitecore experience commerce UPGRADE
Affected: >= 9.2 and <= 10.4
Fixed in: newer than 10.4
Safe to downgrade to: a release before 9.2
1. Check installed version
apt-cache policy experience-commerce || rpm -q experience-commerce || experience-commerce --version
2. UPGRADE to newer than 10.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade experience-commerce
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade experience-commerce
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 9.2 (Debian / Ubuntu)
apt-cache madison experience-commerce
sudo apt install experience-commerce=<VERSION_BEFORE_9.2>
sudo apt-mark hold experience-commerce
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list experience-commerce
sudo dnf downgrade experience-commerce-<VERSION_BEFORE_9.2>
sudo dnf versionlock add experience-commerce
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
sitecore experience manager UPGRADE
Affected: >= 9.2 and <= 10.4
Fixed in: newer than 10.4
Safe to downgrade to: a release before 9.2
1. Check installed version
apt-cache policy experience-manager || rpm -q experience-manager || experience-manager --version
2. UPGRADE to newer than 10.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade experience-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade experience-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 9.2 (Debian / Ubuntu)
apt-cache madison experience-manager
sudo apt install experience-manager=<VERSION_BEFORE_9.2>
sudo apt-mark hold experience-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list experience-manager
sudo dnf downgrade experience-manager-<VERSION_BEFORE_9.2>
sudo dnf versionlock add experience-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
sitecore experience platform UPGRADE
Affected: >= 9.2 and < 10.4 · 10.4
Fixed in: 10.4
Safe to downgrade to: a release before 9.2
1. Check installed version
apt-cache policy experience-platform || rpm -q experience-platform || experience-platform --version
2. UPGRADE to 10.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade experience-platform
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade experience-platform
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 9.2 (Debian / Ubuntu)
apt-cache madison experience-platform
sudo apt install experience-platform=<VERSION_BEFORE_9.2>
sudo apt-mark hold experience-platform
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list experience-platform
sudo dnf downgrade experience-platform-<VERSION_BEFORE_9.2>
sudo dnf versionlock add experience-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
sitecore managed cloud MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy managed-cloud || rpm -q managed-cloud || managed-cloud --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · pipx · FIXED · 1.18.9-1.fc46 · FEDORA-2026-95305954ab · source
sudo dnf upgrade --advisory=FEDORA-2026-95305954ab
Fedora ELN · libisds · FIXED · 0.11.2-19.eln159 · FEDORA-2026-bf61b68668 · source
sudo dnf upgrade --advisory=FEDORA-2026-bf61b68668
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: blueisbeautiful/CVE-2025-53694 (0 stars)
- GitHub PoC: blueisbeautiful/CVE-2025-53694-to-CVE-2025-53691 (0 stars)
- Write-up: labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-53694?
experience commerce: upgrade to newer than 10.4; experience manager: upgrade to newer than 10.4; experience platform: upgrade to 10.4. Exact commands for each OS are on this page.
Is CVE-2025-53694 being exploited?
CVE-2025-53694 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-53694 affect?
CVE-2025-53694 affects experience commerce, experience manager, experience platform. Severity is high (CVSS 7.5). Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience
How urgent is CVE-2025-53694?
Priority 60/100. High severity; EPSS top 6%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-34509 HIGH 7.5 UPGRADE UPGRADE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev
- CVE-2025-53690 CRITICAL 9.0 EXPLOITED UPGRADE UPGRADE Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- CVE-2025-53693 CRITICAL 9.8 UPGRADE UPGRADE Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore S
- CVE-2025-53691 HIGH 8.8 UPGRADE UPGRADE Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platf
- CVE-2025-34511 HIGH 8.8 UPGRADE UPGRADE Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), th