China-Linked APT Group Exploits Zero-Day in Sitecore CMS (CVE-2025-53690)

A China-linked advanced persistent threat group has been observed actively exploiting a previously unknown remote code execution flaw (CVE-2025-53690) in the Sitecore content management platform. The vulnerability affects the Sitecore Experience Platform and Experience Manager and can be triggered without authentication, allowing attackers to execute arbitrary .NET code on vulnerable servers.

The root cause of the flaw lies in insufficient input validation in a deserialization component used by Sitecore for processing incoming requests. When specially crafted data is sent to affected endpoints, the deserializer interprets untrusted content in a way that results in execution of attacker-controlled instructions. Because this occurs before authentication checks, any public-facing Sitecore instance with the vulnerable module exposed is at risk.

In the observed campaign, the threat actor delivered a payload that established a reverse shell on compromised servers and subsequently dropped additional tooling for persistence and lateral movement. The initial access was followed by reconnaissance of local files, credential harvesting, and attempts to propagate to other systems within the network. These behaviors align with known tradecraft of state-linked groups seeking to maintain long-term access.

Sitecore has released an update that corrects the flaw by hardening the deserialization logic and adding stricter input checks. Organizations running Sitecore should prioritize deploying this update and audit server configurations to ensure that administrative endpoints are not unnecessarily exposed to external networks.

Detection of exploitation relies on monitoring unusual process launches under the web service account, unexpected outbound connections, and modification of DLLs or configuration files within the Sitecore installation path. Incident responders should collect memory and disk artifacts from suspected hosts to support forensic analysis, as the post-compromise activity can span multiple tools and stages.

This incident highlights the ongoing threat posed by sophisticated adversaries targeting widely used web platforms with zero-day techniques. It also underscores the importance of continuous patch management and proactive monitoring of public-facing applications to catch exploitation attempts before they escalate into broader network compromise.