# CVE-2025-53693: Sitecore Experience Manager (XM) - Cache Poisoning

> Live exploitation tracking for CVE-2025-53693 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-53693

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)
- **Weaknesses:** CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'))
- **Tags:** cms, enterprise_software

## Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

## CrowdSec analysis

[CVE-2025-53693](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-53693) is a critical unsafe reflection vulnerability in Sitecore Experience Manager (XM) and Experience Platform (XP) that enables attackers to poison the cache by leveraging externally-controlled input. Exploiting this flaw could allow remote attackers to manipulate cached content, potentially leading to the delivery of malicious or incorrect data to users and undermining the integrity and security of affected Sitecore environments.

CrowdSec has been tracking this vulnerability and its exploits since 17th of June 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-53693 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit CVE-2025-53693 by sending crafted POST requests to Sitecore XAML endpoints such as `/-/xaml/<control>` with specially formed `__PARAMETERS` values, attempting to poison the application cache with malicious payloads. These attacks typically target XAML controls like `Sitecore.Shell.Applications.Dialogs.ItemLister.ItemLister` and use methods such as `AddToCache` to inject attacker-controlled content, which can later be retrieved via endpoints like `/sitecore/shell/default.aspx?cache=<key>` or `/sitecore/admin/cache.aspx?key=<key>`.

## Timeline

- 2025-09-03: CVE Published. CVE-2025-53693 is published to NVD.
- 2026-06-17: Rule Released. CrowdSec releases a rule to detect CVE-2025-53693 exploitation attempts against the CrowdSec Network.
- 2026-10-26: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-53693 for the first time.

## References

- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
- https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-53693/exploit.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-53693) follows observed exploitation activity for CVE-2025-53693. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.