How many sitecore Sitecore Experience Manager (XM) CVEs are in CISA KEV?

None of sitecore Sitecore Experience Manager (XM)'s CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of sitecore Sitecore Experience Manager (XM) are affected?

3 distinct sitecore Sitecore Experience Manager (XM) versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in sitecore Sitecore Experience Manager (XM) CVEs?

sitecore Sitecore Experience Manager (XM)'s CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')), CWE-502 (Deserialization of Untrusted Data).

How many critical sitecore Sitecore Experience Manager (XM) vulnerabilities are there?

sitecore Sitecore Experience Manager (XM) has 1 critical and 4 high-severity CVEs.

What is the average severity of sitecore Sitecore Experience Manager (XM) CVEs?

The average CVSS base score across sitecore Sitecore Experience Manager (XM)'s scored CVEs is 8.4.

Sitecore Experience Manager (XM) Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Sitecore Experience Manager (XM) vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Sitecore Experience Manager (XM) Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

Sitecore Experience Manager (XM) has 5 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 8.4.

Severity and exploitation

How the CVSS severity of Sitecore Experience Manager (XM)'s CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High4

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of Sitecore Experience Manager (XM)'s CVEs are currently listed in CISA's KEV catalog.

Public exploits

4 of Sitecore Experience Manager (XM)'s CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Sitecore Experience Manager (XM) version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

9.2 <= v <= 10.42 CVEs
10.0 <= v <= 10.41 CVE
9.0 <= v <= 9.31 CVE

Find a version

5 CVEs

Sort

Sitecore Experience Platform Cross-Site Scripting Vulnerability
CVE-2025-53692CWE-79
High · CVSS 7.1
EPSS 0.4% (30th pct)2025-09-21
Sitecore Experience Remote Code Execution through Insecure Deserialization
CVE-2025-53691
Public exploit
Patch
CWE-502
High · CVSS 8.8
EPSS 1.6% (76th pct)2025-09-03
HTML Cache Poisoning through Unsafe Reflections
CVE-2025-53693
Public exploit
Patch
CWE-470
Critical · CVSS 9.8
EPSS 19.9% (97th pct)2025-09-03
Information Disclosure in ItemServices API
CVE-2025-53694
Public exploit
Patch
CWE-200
High · CVSS 7.5
EPSS 6.7% (94th pct)2025-09-03
Sitecore PowerShell Extension RCE via Unrestricted Upload
CVE-2025-34511
Public exploit
Patch
CWE-434
High · CVSS 8.8
EPSS 29.8% (98th pct)2025-06-17

Common weakness types

The CWE weakness categories most often found in Sitecore Experience Manager (XM) CVEs. Follow any weakness for its full explanation.

Other sitecore products

Browse vulnerabilities for other products by sitecore.

experience platform23 CVEs experience manager11 CVEs managed cloud11 CVEs cms10 CVEs experience commerce10 CVEs Experience Platform (XP)9 CVEs Sitecore Experience Platform (XP)5 CVEs

Frequently asked questions

Common questions about Sitecore Experience Manager (XM) vulnerabilities.

How many CVEs does sitecore Sitecore Experience Manager (XM) have?: sitecore Sitecore Experience Manager (XM) has 5 published CVE records since 2025.
How many sitecore Sitecore Experience Manager (XM) CVEs are in CISA KEV?: None of sitecore Sitecore Experience Manager (XM)'s CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for sitecore Sitecore Experience Manager (XM) vulnerabilities?: Yes — 4 of sitecore Sitecore Experience Manager (XM)'s CVEs have a known public exploit.
Which versions of sitecore Sitecore Experience Manager (XM) are affected?: 3 distinct sitecore Sitecore Experience Manager (XM) versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in sitecore Sitecore Experience Manager (XM) CVEs?: sitecore Sitecore Experience Manager (XM)'s CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')), CWE-502 (Deserialization of Untrusted Data).
How many critical sitecore Sitecore Experience Manager (XM) vulnerabilities are there?: sitecore Sitecore Experience Manager (XM) has 1 critical and 4 high-severity CVEs.
What is the average severity of sitecore Sitecore Experience Manager (XM) CVEs?: The average CVSS base score across sitecore Sitecore Experience Manager (XM)'s scored CVEs is 8.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Sitecore Experience Manager (XM) vulnerabilities

Get an alert for each new Sitecore Experience Manager (XM) CVE, with AI-written analysis and remediation steps.

Create an account See pricing