CVE-2025-34509

Sitecore XM and XP Hardcoded Credentials

State: Published
Severity: 7.5 High
Published: Jun 17, 2025
Updated: Oct 29, 2026
Reserved: Apr 15, 2025

Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
Experience ManagerSitecore	10.4 to before 10.4.1 rev. 011941 PREAffected 10.3 to before 10.3.3 rev. 011967 PREAffected 10.2 to before 10.3Affected 10.1 to before 10.1.4 rev. 011974 PREAffected
Experience PlatformSitecore	10.4 to before 10.4.1 rev. 011941 PREAffected 10.3 to before 10.3.3 rev. 011967 PREAffected 10.2 to before 10.3Affected 10.1 to before 10.1.4 rev. 011974 PREAffected

References

https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/third-party-advisoryexploittechnical-description
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.