What’s Vulnerable › Vulnerabilities
CVE-2025-34509: Sitecore XM and XP Hardcoded Credentials
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 55.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-06-17 · updated 2026-10-29
- Weakness: CWE-798
Description
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
Affected products
- Sitecore Experience Commerce: from 9.0 through 10.4
- Sitecore Experience Manager: from 9.0 through 10.4
- Sitecore Experience Platform: from 9.0 before 10.4; 10.4 — fixed in 10.4
- Sitecore Managed Cloud: all versions
- Sitecore Experience Manager: from 10.4 before 10.4.1 rev. 011941 PRE; from 10.3 before 10.3.3 rev. 011967 PRE; from 10.2 before 10.3; from 10.1 before 10.1.4 rev. 011974 PRE — fixed in 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE, 10.3, 10.1.4 rev. 011974 PRE
- Sitecore Experience Platform: from 10.4 before 10.4.1 rev. 011941 PRE; from 10.3 before 10.3.3 rev. 011967 PRE; from 10.2 before 10.3; from 10.1 before 10.1.4 rev. 011974 PRE — fixed in 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE, 10.3, 10.1.4 rev. 011974 PRE
How to fix
Upgrade to a fixed version: Sitecore Experience Platform 10.4; Sitecore Experience Manager 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE, 10.3, 10.1.4 rev. 011974 PRE; Sitecore Experience Platform 10.4.1 rev. 011941 PRE, 10.3.3 rev. 011967 PRE, 10.3, 10.1.4 rev. 011974 PRE. Check the vendor advisory for mitigations.
References
- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
Get alerted when CVE-2025-34509 or the next vulnerability affects your stack