CVE-2025-34509 - CVE House
Back to Database
Status published High CVE-2025-34509

Sitecore XM and XP Hardcoded Credentials

Vulnerability Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34509

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Piotr Bazydlo of watchTowr

References

More from Sitecore

View All →
CVE-2025-53694
Information Disclosure in ItemServices API
High 7.5
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
Critical 9.8
CVE-2025-53692
Sitecore Experience Platform Cross-Site Scripting Vulnerability
High 7.1
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
High 8.8
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
Critical 9

Affected Vendor

Affected Software

Experience Manager, Experience Platform
Vulnerable Versions:
10.4, 10.3, 10.1

Timeline

Official Publish: June 17th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation