## https://sploitus.com/exploit?id=DD0531B5-3F04-58C2-9FBA-9E2F1BA0B374
### CVE-2025-53691: Remote code execution (RCE) through insecure deserialization
The same reflection mechanism in the `AjaxScriptManager` can be used to invoke the `ProcessSerializedData` method. This method deserializes a provided payload using the insecure `BinaryFormatter`, leading to RCE. An attacker can craft a malicious serialized object to execute arbitrary commands on the server.
**Remote Code Execution:** The attacker uses CVE-2025-53691 to execute arbitrary code on the server.
## Mitigation
Sitecore has released patches for this vulnerabilitie. It is strongly recommended to upgrade to the latest version of Sitecore XP or apply the provided security patches.
## Reference
[1] Watchtowr Labs. (2025). [*Cache Me If You Can: Sitecore Experience Platform Cache Poisoning to RCE*.](https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/)