EM
Product
Experience Manager
On CISA KEVExploited in the wild
11
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 8Medium 0Low 0
Watch
Add Experience Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53690 In wildKEV | 9.0 | Sep 3 | Sitecore Products ViewState Deserialization Vulnerability Affected: through 9.0 |
| CVE-2025-53693 | 9.8 | Sep 3 | HTML Cache Poisoning through Unsafe Reflections Affected: 9.0 through 10.4 |
| CVE-2023-35813 | 9.8 | Jun 17 | Multiple Sitecore products allow remote code execution Affected: 8.2 through 10.3 |
| CVE-2025-53691 | 8.8 | Sep 3 | Sitecore Experience Remote Code Execution through Insecure Deserialization Affected: 9.0 through 10.4 |
| CVE-2025-34511 | 8.8 | Jun 17 | Sitecore PowerShell Extension RCE via Unrestricted Upload Affected: 9.0 through 10.4 |
| CVE-2025-34510 | 8.8 | Jun 17 | Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip Affected: 9.0 through 9.3; 10.0 through 10.4 |
| CVE-2025-53694 | 7.5 | Sep 3 | Information Disclosure in ItemServices API Affected: 9.2 through 10.4 |
| CVE-2025-34509 | 7.5 | Jun 17 | Sitecore XM and XP Hardcoded Credentials Affected: 10.4 before 10.4.1 rev. 011941 PRE; 10.3 before 10.3.3 rev. 011967 PRE; 10.2 before 10.3; 10.1 before 10.1.4 rev. 011974 PRE |
| CVE-2024-46938 | 7.5 | Sep 15 | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release Affected: 8.0 through 10.4 |
| CVE-2023-33651 | 7.5 | Jun 6 | An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release… Affected: 9.0 through 10.3 |
| CVE-2023-26262 | 7.2 | Mar 14 | An issue was discovered in Sitecore XP/XM 10.3 Affected: through 10.3 |
Showing 11