PatchTheCVEmanaged cloud vulnerabilities and fixes
Recent CVEs affecting managed cloud, with upgrade or downgrade steps. 7 tracked.
Also searched as: managedcloud.
managed cloud has 7 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 7. Most recent: 2025-09-03. Highest priority: CVE-2025-53690 (score 91/100).
- CVE-2025-34509 HIGH 7.5 UPGRADE UPGRADE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev
- CVE-2025-53690 CRITICAL 9.0 EXPLOITED UPGRADE UPGRADE Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- CVE-2025-53693 CRITICAL 9.8 UPGRADE UPGRADE Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore S
- CVE-2025-53694 HIGH 7.5 UPGRADE UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manag
- CVE-2025-53691 HIGH 8.8 UPGRADE UPGRADE Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platf
- CVE-2025-34511 HIGH 8.8 UPGRADE UPGRADE Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), th
- CVE-2025-34510 HIGH 8.8 UPGRADE UPGRADE Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through
FAQ
How do I fix managed cloud vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is managed cloud being exploited right now?
Yes: 1 managed cloud CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which managed cloud CVE should I patch first?
CVE-2025-53690 currently ranks highest (91/100): Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability.