CVE-2025-53690: Sitecore Deployments Targeted via WEEPSTEEL Malware

CVE-2025-53690 affects older Sitecore deployments, with exposed static machine keys in Sitecore XP 9.0, Active Directory module 1.4 and earlier versions, making these environments vulnerable to a zero-day style attack that can yield remote code execution. According to CISA, CVE-2025-53690 has been added to the Known Exploited Vulnerabilities catalog with a remediation due date of 25 September 2025.

The exploit targets the /sitecore/blocked.aspx entry point, using a compromised ViewState and the exposed machine key to run malicious payloads, after which WEEPSTEEL acts as the first-stage malware to gather host, process, disk and network details and exfiltrate data as ViewState responses.

The attackers’ toolchain also includes EARTHWORM, DWAgent and SharpHound, with further steps such as creating local admin accounts and attempting token theft via GoTokenTheft, while disabling password expiration policies and maintaining RDP access. Google Cloud Blog provides a threat lifecycle visualisation of the attack, and Sitecore’s advisory SC2025-005 is cited for remediation guidance.