CVE-2025-53691: Sitecore Experience Commerce

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Affected products

• Sitecore Experience Commerce: from 9.0, up to and including 10.4
• Sitecore Experience Manager: from 9.0, up to and including 10.4
• Sitecore Experience Platform: from 9.0, before 10.4 (fixed in 10.4); version 10.4 only
• Sitecore Managed Cloud: affected versions not specified

Published 2025-09-03. Last modified 2026-06-17.