CVE-2025-34509highobserved exploitationCWE-798

CVE-2025-34509: high-severity vulnerability in Sitecore Experience Manager

Sitecore XM and XP Hardcoded Credentials

Published · Updated

Follow this CVE+ Monitor Experience Platform+ Monitor Experience Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 7.5epss 56%
from disclosure to weapon
Published on NVDJun 17
VulnCheck+5d
In short

Sitecore XM and XP contain a hardcoded username and password built into the software. An attacker can use this account to remotely access administrative features without needing legitimate credentials, potentially compromising the entire website.

Technical detail

Sitecore XM and XP versions 10.1–10.4.1 contain hardcoded credentials (CWE-798) embedded in the application. Unauthenticated remote attackers can leverage these credentials to authenticate to administrative APIs exposed over HTTP, bypassing authentication controls and gaining unauthorized administrative access.

Summary generated and translated by AI from the official description.
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Sitecore · Experience ManagerSitecore · Experience Platform
Related CVEs — Sitecore Experience Manager

In the same product, most dangerous first.

CVE-2025-34510HIGHSitecore XM, XC, and XP Post-Auth RCE via Zip SlipEPSS 24.8%CVE-2022-4979MEDIUMSitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSSEPSS 0.7%