CVE-2025-34509

Sitecore XM and XP Hardcoded Credentials

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Affected

Sitecore · Experience Manager · Experience Platform

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

55.87% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-798

Published

2025-06-17

Updated

2026-02-26

Proof-of-concept exploits (1)

• https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-pl…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34509.yaml

Security advisories

• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
• https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-pl…

References

• CVE Record
• NVD entry