4 CVEs
1 in CISA KEV
sitecore Experience Manager (XM) Vulnerabilities
CVE security advisories and vulnerability history for Experience Manager (XM) by sitecore.
4
Total CVEs
Published
1
In CISA KEV
Exploited in the wild
3
Public exploits
CVE security advisories and vulnerability history for Experience Manager (XM) by sitecore.
Last updated
sitecore Experience Manager (XM) has 4 published CVE records since 2025, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 8.8.
How the CVSS severity of sitecore Experience Manager (XM)'s CVEs breaks down, plus how many are exploited in the wild or have public exploit code.
In CISA’s Known Exploited Vulnerabilities catalog
1
One of sitecore Experience Manager (XM)'s CVEs is confirmed exploited in the wild.
Public exploits
3
3 of sitecore Experience Manager (XM)'s CVEs have a known public exploit available.
Browse every sitecore Experience Manager (XM) version named in a CVE, then pick one to see only the CVEs that affect it.
4 CVEs
Added to CISA KEV 2025-09-04
The CWE weakness categories most often found in sitecore Experience Manager (XM) CVEs. Follow any weakness for its full explanation.
Browse vulnerabilities for other products by sitecore.
Common questions about sitecore Experience Manager (XM) vulnerabilities.
Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.
Get an alert for each new sitecore Experience Manager (XM) CVE, with AI-written analysis and remediation steps.