Product by Sitecore
Sitecore Experience Manager
11 known vulnerabilities in Sitecore Experience Manager (Sitecore), 1 of them actively exploited (CISA KEV).
Key figures
11
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-53690 | Sitecore Products ViewState Deserialization Vulnerability In CISA KEValso in 5 other products | 9.0 | |
| Critical | CVE-2025-53693 | HTML Cache Poisoning through Unsafe Reflections | 9.8 | |
| Critical | CVE-2023-35813 | Sitecore Experience Commerce: Remote Code Execution | 9.8 | |
| High | CVE-2025-34511 | Sitecore PowerShell Extension RCE via Unrestricted Upload | 8.8 | |
| High | CVE-2025-34510 | Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip | 8.8 | |
| High | CVE-2025-34509 | Sitecore XM and XP Hardcoded Credentials | 7.5 | |
| High | CVE-2024-46938 | Sitecore Experience Commerce: security vulnerability | 7.5 | |
| High | CVE-2025-53694 | Information Disclosure in ItemServices API | 7.5 | |
| High | CVE-2025-53691 | Sitecore Experience Remote Code Execution through Insecure Deserialization | 8.8 | |
| High | CVE-2023-26262 | Sitecore Experience Manager: Code Execution | 7.2 | |
| High | CVE-2023-33651 | Sitecore Experience Commerce: security vulnerability | 7.5 |