Sitecore CVE-2025-53690 Exploit Attempt

Tim Peck@timpeck

•updated Sep 8, 2025•1•0•53

Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.