CVE-2025-53694 - CVE House
Back to Database
Status published High CVE-2025-53694

Information Disclosure in ItemServices API

Vulnerability Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53694

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Piotr Bazydlo of watchTowr

References

More from Sitecore

View All →
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Critical 9.8
CVE-2025-53692
Sitecore Experience Platform Cross-Site Scripting Vulnerability
High 7.1
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
High 8.8
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Critical 9
CVE-2025-34511
Sitecore PowerShell Extension RCE via Unrestricted Upload
High 8.8

Affected Vendor

Affected Software

Sitecore Experience Manager (XM), Experience Platform (XP)
Vulnerable Versions:
9.2

Timeline

Official Publish: September 3rd, 2025
Last Modified: September 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration