--- title: "Sitecore CVE-2025-53690: Sample Machine Key ViewState RCE" url: https://erroneo.us/security/briefs/sitecore-viewstate-sample-machine-key-cve-2025-53690/ description: "Sitecore XM, XP and XC sites using the sample ASP.NET machine key from old guides can be taken over via ViewState. No patch fixes it: rotate the key and hunt." type: security-brief section: "Security Digest" date_published: 2025-09-03 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2025-53690"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Sitecore CVE-2025-53690: Sample Machine Key ViewState RCE **Verdict: Check exposure.** If any Sitecore instance ever ran with the sample machine key, or a static key that may have leaked, rotate it and hunt for compromise; upgrading alone does not fix this. - **Who must act:** Sitecore XM, XP and XC operators, including Managed Cloud, whose web.config machineKey came from a deployment guide or is a static key shared across instances. - **Who can relax:** Users of SitecoreAI, Content Hub, CDP and Personalize, OrderCloud, Search, Commerce Server and the other products Sitecore lists as not affected, and sites with unique, rotated keys. - **Affected:** Sitecore XM, XP and XC deployed with the sample machine key from deployment instructions for XP 9.0 or earlier and Active Directory 1.4; Any XM, XP or XC release in multi-instance mode with customer-managed static machine keys (potentially, per Sitecore); Managed Cloud Standard and Premium (potentially, per Sitecore) - **Fixed:** No version fix: rotate the machine keys in web.config and protect them (Sitecore SC2025-005); Newer Sitecore deployments generate a unique machine key automatically (per Mandiant) - **CVEs:** CVE-2025-53690 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Check every Sitecore role's web.config for a machineKey element and find out where its values came from. 2. Generate new validation and decryption keys, deploy them to all instances, and rotate them on a schedule. 3. Encrypt the machineKey section and restrict web.config access to application administrators. 4. Make sure ViewState MAC validation is enabled. 5. Hunt for compromise before and after rotation, since a stolen key works until it is changed. ### How to check if you are affected - Search the Windows Application log for ASP.NET event ID 1316 with event code 4009 and 'Viewstate verification failed. Reason: Viewstate was invalid.' - Search IIS logs for POST requests to /sitecore/blocked.aspx, the endpoint Mandiant saw abused without authentication. - Look for new local admins such as asp$ or sawadmin, net user /add or reg save HKLM\SAM launched by w3wp.exe, and tools staged in C:\Users\Public\Music. - Check for EARTHWORM tunnels, DWAgent services and connections to 130.33.156.194 or 103.235.46.102. ## What happened On September 3, 2025, Sitecore published [Security Bulletin SC2025-005](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865) for CVE-2025-53690. The flaw is in how some sites were configured, not in a code path a patch can remove. Deployment instructions for Sitecore XP 9.0 and earlier, and for Active Directory 1.4, included a sample ASP.NET machine key. Sites that pasted it into `web.config` share a secret anyone can look up. With it, an attacker can build a signed ViewState payload that the server deserializes and runs. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-53690) scores it CVSS 9.0, and CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53690) the next day. Mandiant found it during an incident response and described the attack the same day in a [detailed write-up](https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability). The attacker sent a crafted ViewState to `/sitecore/blocked.aspx`, which needs no authentication. The payload carried a .NET reconnaissance tool Mandiant calls WEEPSTEEL. Running as `NETWORK SERVICE`, the attacker archived the web root, including `web.config`, and staged EARTHWORM (a SOCKS tunnel), DWAgent (remote access) and SharpHound in `C:\Users\Public\Music`. They then created local admins `asp$` and `sawadmin`, dumped the SAM and SYSTEM hives, and moved laterally over RDP. Mandiant says the key "had been exposed in Sitecore deployment guides from 2017 and earlier." ## Who is affected Sitecore lists Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC) and Managed Cloud. The clearest case is any deployment built with the sample key from the XP 9.0 or Active Directory 1.4 instructions. Sitecore also warns that any XM, XP or XC release may be affected in multi-instance mode with customer-managed static keys, and that both Managed Cloud Standard and Premium might be. SitecoreAI, Content Hub, CDP and Personalize, OrderCloud, Storefront, Send, Discover, Search and Commerce Server are not affected. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-53690) lists XM, XP and XC through 9.0 plus Managed Cloud. ## Do you really need to act? Check, yes. Mandiant notes that newer deployments generate a unique machine key automatically, so a clean modern install is fine. The risk is long-lived sites. A deployment first built from a 2017-era guide may have carried the same `machineKey` through every upgrade, because the key lives in configuration, not code. Upgrading Sitecore does not rotate it. Static keys reused across many instances are also worth rotating, since one leaked `web.config` exposes them all. ## What to do now 1. Find every key: `Get-ChildItem C:\inetpub -Recurse -Filter web.config | Select-String '