PatchTheCVEsitecore vulnerabilities
Recent CVEs affecting sitecore products. 8 tracked.
sitecore has 8 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 8. Most recent: 2025-09-03. Highest priority: CVE-2025-53690 (score 91/100).
- CVE-2025-53690 CRITICAL 9.0 EXPLOITED UPGRADE UPGRADE Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability
- CVE-2025-53693 CRITICAL 9.8 UPGRADE UPGRADE Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore S
- CVE-2025-53694 HIGH 7.5 UPGRADE UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manag
- CVE-2025-53691 HIGH 8.8 UPGRADE UPGRADE Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platf
- CVE-2025-34511 HIGH 8.8 UPGRADE UPGRADE Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), th
- CVE-2025-34510 HIGH 8.8 UPGRADE UPGRADE Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through
- CVE-2025-34509 HIGH 7.5 UPGRADE UPGRADE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev
- CVE-2024-46938 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce
FAQ
How do I fix sitecore vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sitecore being exploited right now?
Yes: 1 sitecore CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which sitecore CVE should I patch first?
CVE-2025-53690 currently ranks highest (91/100): Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability.