High 7.5Published Jun 17, 2025

CVE-2025-34509Sitecore XM and XP Hardcoded Credentials

Updated under an hour ago (Oct 30, 2026, 6:40 AM ET)

Does this affect you?

It affects Sitecore Experience Manager and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Sitecore Experience Manager Exploited in the last 30 days

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-798
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Modified
Record last updated: Oct 29, 2026
First seen by InfoSec Signals: Oct 29, 2026

Affected products

Affected products

Sitecore Experience Manager sitecore:experience_manager (from the name)	from 10.4 before 10.4.1 rev. 011941 PRE; from 10.3 before 10.3.3 rev. 011967 PRE; from 10.2 before 10.3; from 10.1 before 10.1.4 rev. 011974 PRE	CNA record
Sitecore Experience Platform sitecore:experience_platform (from the name)	from 10.4 before 10.4.1 rev. 011941 PRE; from 10.3 before 10.3.3 rev. 011967 PRE; from 10.2 before 10.3; from 10.1 before 10.1.4 rev. 011974 PRE	CNA record
sitecore experience_commerce sitecore:experience_commerce	from 9.0 through 10.4	NVD
sitecore experience_manager sitecore:experience_manager	from 9.0 through 10.4	NVD
sitecore experience_platform sitecore:experience_platform	from 9.0 before 10.4; 10.4	NVD
sitecore managed_cloud sitecore:managed_cloud	all versions	NVD

References

References

https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/	third-party-advisory, exploit, technical-description
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.