Sitecore Zero-Day Sparks New Round of ViewState Threats

A critical Sitecore zero-day vulnerability, tracked as CVE-2025-53690, is under active exploitation in a new round of ViewState deserialization attacks affecting Sitecore products such as Experience Manager, Experience Platform and Experience Commerce, according to Mandiant. The flaw permits remote code execution when ASP.NET machine keys are exposed, enabling attackers to leverage a sample key from 2017 deployment guides to weaponise the attack in the wild.

Mandiant noted that the exploitation arose from an exposed machine key rather than a privately disclosed secret, and highlighted how the issue fits into a broader pattern of ViewState abuses this year. Microsoft previously warned there are around 3,000 publicly disclosed ASP.NET machine keys that could be weaponised for similar attacks, a risk amplified by their presence in multiple code repositories.

The article also references related incidents, including Gladinet’s CentreStack (CVE-2025-30406), a ConnectWise breach (CVE-2025-3935) and a Microsoft SharePoint Server vulnerability (CVE-2025-53770) in attacks linked to ViewState code injection. Sitecore urges customers to rotate and secure machine keys, encrypt any machineKey elements in web.config files, and restrict web.config access to administrators.