Vulnerability · Published Jun 17, 2025 · Assigned by VulnCheck
CVE-2025-34509Sitecore XM and XP Hardcoded Credentials
High 7.5
In plain English
A high-severity hard-coded credentials in Experience Manager from Sitecore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 55.9% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sitecore | Experience Manager | 10.4 – before 10.4.1 rev. 011941 PRE10.3 – before 10.3.3 rev. 011967 PRE10.2 – before 10.310.1 – before 10.1.4 rev. 011974 PRE |
| Sitecore | Experience Platform | 10.4 – before 10.4.1 rev. 011941 PRE10.3 – before 10.3.3 rev. 011967 PRE10.2 – before 10.310.1 – before 10.1.4 rev. 011974 PRE |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/ third-party-advisory, exploit, technical-description
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 vendor-advisory