Three new safety vulnerabilities have been disclosed within the Sitecore Expertise Platform that could possibly be exploited to realize info disclosure and distant code execution.
The failings, per watchTowr Labs, are listed under –
- CVE-2025-53693 – HTML cache poisoning by way of unsafe reflections
- CVE-2025-53691 – Distant code execution (RCE) by way of insecure deserialization
- CVE-2025-53694 – Info Disclosure in ItemService API with a restricted nameless person, resulting in publicity of cache keys utilizing a brute-force method
Patches for the primary two shortcomings had been launched by Sitecore in June and for the third in July 2025, with the corporate stating that “profitable exploitation of the associated vulnerabilities would possibly result in distant code execution and non-authorized entry to info.”
The findings construct on three extra flaws in the identical product that had been detailed by watchTowr again in June –
- CVE-2025-34509 (CVSS rating: 8.2) – Use of hard-coded credentials
- CVE-2025-34510 (CVSS rating: 8.8) – Publish-authenticated distant code execution by way of path traversal
- CVE-2025-34511 (CVSS rating: 8.8) – Publish-authenticated distant code execution by way of Sitecore PowerShell Extension
watchTowr Labs researcher Piotr Bazydlo stated the newly uncovered bugs could possibly be original into an exploit chain by bringing collectively the pre-auth HTML cache poisoning vulnerability with a post-authenticated distant code execution problem to compromise a fully-patched Sitecore Expertise Platform occasion.
Your complete sequence of occasions main as much as code execution is as follows: A risk actor may leverage the ItemService API, if uncovered, to trivially enumerate HTML cache keys saved within the Sitecore cache and ship HTTP cache poisoning requests to these keys.
This might then be chained with CVE-2025-53691 to produce malicious HTML code that finally leads to code execution via an unrestricted BinaryFormatter name.
“We managed to abuse a really restricted reflection path to name a way that lets us poison any HTML cache key,” Bazydlo stated. “That single primitive opened the door to hijacking Sitecore Expertise Platform pages – and from there, dropping arbitrary JavaScript to set off a Publish-Auth RCE vulnerability.”
