Sitecore Experience Platform ViewState Insecure Deserialization (CVE-2025-53690)

Tim Peck@timpeck

•updated Nov 11, 2025•0•39

This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-53690) in Sitecore Experience Platform via exposed ASP.NET MachineKeys. It specifically looks for HTTP POST requests to '/sitecore/blocked.aspx' containing a '__VIEWSTATE' parameter with a highly encoded string, indicative of a crafted ViewState payload used in deserialization attacks.