CISA Orders Immediate Patch of Critical Sitecore Vulnerability Under Active Exploitation

According to The Hacker News article summarising a CISA alert, federal agencies are being advised to update their Sitecore instances by 25 September 2025 after the discovery of a security flaw now under active exploitation in the wild. The vulnerability, tracked as CVE-2025-53690, carries a CVSS score of 9.0 out of 10, and specifically affects Sitecore Experience Manager, Experience Platform, Experience Commerce, and Managed Cloud due to a deserialization of untrusted data involving default ASP.NET machine keys.

The agency stated that the flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution. Mandiant, which identified the active ViewState deserialization attack, noted the activity leveraged a sample machine key exposed in Sitecore deployment guides from 2017 and earlier, and did not link the activity to a named threat actor or group. Countermeasures include rotating the ASP.NET machine keys, tightening configurations, and scanning for signs of compromise.