CVE-2025-53693 is a critical 'Unsafe Reflection' vulnerability affecting Sitecore Experience Manager (XM) and Experience Platform (XP) versions 9.0 through 10.4. This flaw allows for cache poisoning due to the use of externally-controlled input to select classes or code. With a CVSS score of 9.8 (CRITICAL), it presents a high risk (FAUCET Risk Score 95/100) with network-based exploitation, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not yet in the KEV catalog, recent community discussion indicates it can be chained with other Sitecore vulnerabilities (CVE-2025-53691 and CVE-2025-53694) to achieve hijacked pages and remote code execution, even on patched systems. There is currently no public exploit code available in Metasploit, Nuclei, or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 9.0, <= 10.4CPE matchmatch criteria | cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:* | ||
>= 9.0, <= 10.4CPE matchmatch criteria | cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:* | ||
>= 9.0, < 10.4CPE matchmatch criteria | cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:* | ||
10.4CPE matchmatch criteria | cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.