CVE-2025-34139highCWE-522CWE-552

CVE-2025-34139: high-severity vulnerability in Sitecore Managed Cloud

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read

Published · Updated

Follow this CVE+ Monitor Experience Platform+ Monitor Experience Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Sitecore · Experience Commerce (XC)Sitecore · Experience Manager (XM)Sitecore · Experience Platform (XP)Sitecore · Managed Cloud
Related CVEs — Sitecore Managed Cloud

In the same product, most dangerous first.

CVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 60.7%KEVCVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2025-53694HIGHInformation Disclosure in ItemServices APIEPSS 6.9%CVE-2025-53691HIGHSitecore Experience Remote Code Execution through Insecure DeserializationEPSS 1.6%CVE-2015-10142MEDIUMSitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathEPSS 0.6%CVE-2025-53692HIGHSitecore Experience Platform Cross-Site Scripting VulnerabilityEPSS 0.4%