CVE-2025-53693

The vulnerability results from the use of externally controlled input data to select classes or code in the reflection mechanism (CWE-470). An attacker can provide crafted input that the application uses to dynamically load or execute a class, leading to cache poisoning. The lack of authentication requirements (PR:N, UI:N) means that the exploit can be carried out remotely over the network without any user interaction.

An attacker can cause cache poisoning, which threatens the confidentiality, integrity, and availability of the system. According to publicly available references, the vulnerability can be escalated to remote code execution (RCE).

Patches available from the vendor should be applied according to the references — details are available in the Sitecore knowledge base article KB1003667. It is recommended to immediately verify the deployed versions and apply available patches.

Sitecore Experience Manager (XM) in versions 9.0 to 9.3 and 10.0 to 10.4; Sitecore Experience Platform (XP) in versions 9.0 to 9.3 and 10.0 to 10.4. Also affects Sitecore Experience Commerce and Sitecore Managed Cloud.