Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution

Three new security vulnerabilities in the Sitecore Experience Platform could be abused to achieve information disclosure and remote code execution, with flaws listed as CVE-2025-53693 (HTML cache poisoning through unsafe reflections), CVE-2025-53691 (Remote code execution via insecure deserialization), and CVE-2025-53694 (Information Disclosure in ItemService API exposing cache keys).

Patches for the first two were released by Sitecore in June and the third in July 2025, the company noting that successful exploitation of the related vulnerabilities might lead to remote code execution and non-authorized access to information.

According to watchTowr Labs, the findings build on three earlier flaws in the same product detailing hard-coded credentials and post-authenticated RCE paths. watchTowr Labs researcher Piotr Bazydlo said the newly uncovered bugs could be fashioned into an exploit chain by linking the pre-auth HTML cache poisoning with a post-authenticated RCE issue to compromise a fully-patched Sitecore Experience Platform instance.

The sequence described involves a threat actor using the ItemService API to enumerate HTML cache keys and then triggering cache poisoning before supplying malicious HTML to enable code execution via a BinaryFormatter call.