CVE-2025-34509: Sitecore XM and XP Hardcoded Credentials

Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)55.9% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EM

Experience Manager · Sitecore

10.4 before 10.4.1 rev. 011941 PRE; 10.3 before 10.3.3 rev. 011967 PRE; 10.1 before 10.1.4 rev. 011974 PRE · source: vendor, NVD

EP

Experience Platform · Sitecore

10.4 before 10.4.1 rev. 011941 PRE; 10.3 before 10.3.3 rev. 011967 PRE; 10.1 before 10.1.4 rev. 011974 PRE · source: vendor, NVD

EC

Experience Commerce · Sitecore

9.0 through 10.4 · source: NVD

MC

Managed Cloud · Sitecore

All versions, or not specified · source: NVD