Google Alerts to Active Exploitation of Sitecore Zero-Day Flaw

Security researchers warn of an active exploitation of Sitecore’s zero-day flaw, tracked as CVE-2025-53690, which attackers can trigger by tampering with the ViewState mechanism in ASP.NET. The vulnerability allows remote code execution on unpatched servers when a sample machine key from older Sitecore deployment guides is used, a situation Sitecore says should be avoided by generating a unique key.

The weakness was first spotted by Mandiant Threat Defense during an incident response, with attackers sending crafted POST requests to /sitecore/blocked.aspx to trigger a ViewState validation failure. In the attack chain, the malware called WEEPSTEEL performs internal reconnaissance, followed by archiving activities using 7-Zip and staging tools such as EARTHWORM, with a remote access tool named DWAGENT enabling persistence.

Sitecore notes affected products include Sitecore XP 9.0 and Active Directory 1.4 or earlier when deployed with the sample key, and urges administrators to rotate machine keys and apply updated patches, as outlined in advisory SC2025-005. According to Google, security teams have issued warnings and emphasise monitoring outbound traffic for unusual tunnelling and RDP sessions.