CISA orders federal agencies to patch Sitecore zero-day following hacking reports

CISA has ordered federal civilian agencies to patch a Sitecore zero-day after incident responders disrupted a recent attack linked to the bug, with a patch deadline of 25 September 2025. The vulnerability is identified as CVE-2025-53690, and Sitecore published a bulletin about it, noting a key issue involving a sample machine key that appeared in deployment guides from 2017 and earlier. According to the report, many customers used the sample key and did not rotate it to a new value. Mandiant said it recently stopped an attack in which hackers leveraged the exposed sample machine key to gain access. Read more at The Record.