Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 04/09/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| experience commerce | ≤ 9.0 | |
| experience manager | ≤ 9.0 | |
| experience platform | ≤ 9.0 |
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free