Sitecore Experience Manager (XM) - Cache Poisoning (CVE-2025-53693)

CVE-2025-53693 is a critical unsafe reflection vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) that enables attackers to poison the cache by leveraging externally-controlled input. Exploiting this flaw could allow remote attackers to manipulate cached content, potentially leading to the delivery of malicious or incorrect data to users and undermining the integrity and security of affected Sitecore environments.

CrowdSec has been tracking this vulnerability and its exploits since 17th of June 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-53693 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit CVE-2025-53693 by sending crafted POST requests to Sitecore XAML endpoints such as /-/xaml/<control> with specially formed __PARAMETERS values, attempting to poison the application cache with malicious payloads. These attacks typically target XAML controls like Sitecore.Shell.Applications.Dialogs.ItemLister.ItemLister and use methods such as AddToCache to inject attacker-controlled content, which can later be retrieved via endpoints like /sitecore/shell/default.aspx?cache=<key> or /sitecore/admin/cache.aspx?key=<key>.