Hackers Exploit Zero-Day Flaw in Sitecore for Backdoors and Malware
TL;DR
Threat actors exploited a zero-day vulnerability in legacy Sitecore systems (CVE-2025-53690) involving a ViewState deserialization flaw caused by reused sample ASP.NET machine keys, leading to remote code execution and deployment of reconnaissance malware WeepSteel. The attack involved multi-stage exploits including privilege escalation and persistence techniques. Sitecore recommends immediate replacement and encryption of static machine keys to mitigate the vulnerability.
- Hackers exploited Sitecore zero-day flaw to deploy backdoors BleepingComputer
- Hackers Exploit Sitecore Zero-Day for Malware Delivery SecurityWeek
- Researchers Warn of Sitecore Exploit Chain Linking Cache Poisoning and Remote Code Execution The Hacker News
- Researchers warn of zero-day vulnerability in SiteCore products Yahoo Finance
- Sitecore customers hit by hackers: Pasted keys blamed The Stack
Want the full story? Read the original reporting
Read on BleepingComputer