Executive Summary A critical zero-day vulnerability in Sitecore, tracked as CVE-2025-53690, has been exploited in the wild to deploy the WeepSteel backdoor. This flaw, an insecure deserialization issue, allows attackers to craft malicious ViewState payloads using default or sample ASP.NET machineKey values. Exploitation leads to remote code execution (RCE) on vulnerable Sitecore servers, enabling credential […]
The post WeepSteel Rises: Attackers Exploit Critical Sitecore Deserialization Bug appeared first on SecPod Blog.