CISA orders federal agencies to patch Sitecore zero-day following hacking reports

Sitecore disclosed CVE-2025-53690 affecting multiple products where many deployments used an unchanged sample ASP.NET machine key; Mandiant reported stopping an attack that used the exposed key to compromise internet-facing Sitecore instances, deploy WEEPSTEEL reconnaissance malware, escalate privileges, and attempt to access sensitive files and create admin accounts. Sitecore now auto-generates unique machine keys for new deployments, customers were advised to rotate keys and search for suspicious activity, and CISA added the vulnerability to its known exploited vulnerabilities catalog with a September 25 patch deadline for federal civilian agencies.