CVE-2025-53690: Mandiant and Sitecore Warn of Active Exploitation in ASP.NET Machine Key Configurations

CVE-2025-53690 has been disclosed as being actively exploited, with Mandiant and Sitecore warning that a critical misconfiguration in ASP.NET machine keys can enable remote code execution. The flaw arises from publicly exposed ASP.NET machine keys in older Sitecore deployment guides, allowing ViewState deserialization attacks that attackers can chain to full remote code execution, with CVSS listed at 9.0.

The risk chiefly affects customers running Sitecore XP 9.0 or earlier with Active Directory 1.4 or earlier, where legacy documentation provided sample machine keys. According to Mandiant and Sitecore, an attacker leveraged the exposed keys to perform remote code execution against affected Sitecore instances, as observed in the exploitation chain that started with the /sitecore/blocked.aspx endpoint and included malicious ViewState payloads, a WEEPSTEEL reconnaissance tool, and persistence via EARTHWORM and DWAGENT.

Mitigations call for rotating and encrypting machine keys in web.config, restricting access to web.config, and routinely inspecting environments for suspicious activity, with emphasis on adopting key rotation as a standard practice, particularly for customer-managed static keys. Sitecore also urged organisations to examine their environments for suspicious behaviour in addition to protecting ASP.NET machine keys, following guidance from Microsoft Threat Intelligence, Mandiant Threat Intelligence and Sitecore.