Hackers Exploit Sitecore Zero-Day for Malware Delivery

According to Google, threat actors have been mass-exploiting a Sitecore zero-day by using an exposed ASP.NET machine key to perform ViewState deserialization attacks on internet-accessible Sitecore deployments. The issue is tracked as CVE-2025-53690, with a CVSS score of 9.0, and affects Sitecore Experience Manager and Experience Platform prior to version 9.0 that were deployed using the sample key from older guides.

Google notes that attacks began with HTTP requests and targeted the /sitecore/blocked.aspx page, exploiting a deserialization vulnerability to exfiltrate data via a WeepSteel payload. The attacker activity included archiving the web root, fingerprinting the server, deploying open source tools for tunnelling and remote access, creating local administrator accounts, and establishing remote desktop access before dumping SYSTEM and SAM hives. Sitecore has addressed the defect and released an advisory with mitigation guidance and IoCs, and instances of the attacks were quickly disrupted.