PatchTheCVEexperience commerce vulnerabilities and fixes
Recent CVEs affecting experience commerce, with upgrade or downgrade steps. 8 tracked.
Also searched as: experiencecommerce.
experience commerce has 8 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 8. Most recent: 2025-09-03. Highest priority: CVE-2025-53690 (score 91/100).
- CVE-2025-34509 HIGH 7.5 UPGRADE UPGRADE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev
- CVE-2025-53690 CRITICAL 9.0 EXPLOITED UPGRADE UPGRADE Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- CVE-2025-53693 CRITICAL 9.8 UPGRADE UPGRADE Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore S
- CVE-2025-53694 HIGH 7.5 UPGRADE UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manag
- CVE-2025-53691 HIGH 8.8 UPGRADE UPGRADE Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platf
- CVE-2025-34511 HIGH 8.8 UPGRADE UPGRADE Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), th
- CVE-2025-34510 HIGH 8.8 UPGRADE UPGRADE Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through
- CVE-2024-46938 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce
FAQ
How do I fix experience commerce vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is experience commerce being exploited right now?
Yes: 1 experience commerce CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which experience commerce CVE should I patch first?
CVE-2025-53690 currently ranks highest (91/100): Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability.