Researchers warn of zero-day vulnerability in SiteCore products

Security researchers from Google on Wednesday warned of a zero-day vulnerability they discovered in the SiteCore content management system platform in connection with a ViewState deserialization ...
Bleeping Computer

Hackers exploited Sitecore zero-day flaw to deploy backdoors

Threat actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware. The flaw, tracked under CVE-2025-53690, is a ViewState ...
Bleeping Computer

Sitecore CMS exploit chain starts with hardcoded 'b' password

A chain of Sitecore Experience Platform (XP) vulnerabilities allows attackers to perform remote code execution (RCE) without authentication to breach and hijack servers. Sitecore is a popular ...
CSOonline

Sitecore zero-day configuration flaw under active exploitation

Attackers are leveraging a sample machine key in Sitecore products for initial access before ViewState code injections lead to escalated privileges and lateral movement across the network. A sample ...
Infosecurity-magazine.com

Chained Flaws in Enterprise CMS Provider Sitecore Could Allow Remote Code Execution

Vulnerability research firm WatchTowr has detected seven vulnerabilities in Sitecore, a popular content management system (CMS) provider used by HSBC, United Airlines, P&G and L’Oréal. In its first ...