
Remote code execution (RCE) through insecure deserialization
The same reflection mechanism in the AjaxScriptManager can be used to invoke the ProcessSerializedData method. This method deserializes a provided payload using the insecure BinaryFormatter, leading to RCE. An attacker can craft a malicious serialized object to execute arbitrary commands on the server.
Remote Code Execution: The attacker uses CVE-2025-53691 to execute arbitrary code on the server.
Sitecore has released patches for this vulnerabilitie. It is strongly recommended to upgrade to the latest version of Sitecore XP or apply the provided security patches.
[1] Watchtowr Labs. (2025). Cache Me If You Can: Sitecore Experience Platform Cache Poisoning to RCE.