Vulnerabilities in Sitecore CMS Platform Allow Excute Arbitrary Code Remotely

Security researchers have uncovered a chain of vulnerabilities in Sitecore Experience Platform that could allow attackers to fully compromise sites without authentication. The most severe is CVE-2025-53693, an HTML cache poisoning flaw that lets attackers overwrite legitimate cached content by crafting requests to the “/-/xaml/” endpoint and using the AddToCache method, with zero authentication required and the poisoned cache appearing normal to visitors.

Building on this, a post-authentication remote code execution flaw (CVE-2025-53691) exploits insecure deserialization in the ConvertToRuntimeHtml pipeline, using user-controlled HTML content and the unsafe BinaryFormatter to execute arbitrary code, potentially via the Content Editor with only basic privileges.

The vulnerabilities affect Sitecore Experience Platform version 10.4.1 and potentially earlier versions, impacting an estimated 22,000 Sitecore instances worldwide according to internet scanning data, with patches released in June and July 2025 after reports in February and March. According to watchTowr Labs, the attack chain could enable attackers to poison caches pre-authentication and then execute code post-authentication, enabling persistent access and widespread impact.

Organisations should immediately verify they have applied the latest security patches and review their ItemService API configurations to prevent internet exposure.