{"id":"CVE-2025-34509","published":"2025-06-17T18:20:57Z","modified":"2026-10-29T21:15:17Z","title":"Sitecore XM and XP Hardcoded Credentials","vendor":"Sitecore","product":"Experience Manager","tier":"core","eol":null,"affectedVersions":[{"vendor":"Sitecore","product":"Experience Manager","versions":[">= 10.4, < 10.4.1 rev. 011941 PRE",">= 10.3, < 10.3.3 rev. 011967 PRE",">= 10.2, < 10.3",">= 10.1, < 10.1.4 rev. 011974 PRE"]},{"vendor":"Sitecore","product":"Experience Platform","versions":[">= 10.4, < 10.4.1 rev. 011941 PRE",">= 10.3, < 10.3.3 rev. 011967 PRE",">= 10.2, < 10.3",">= 10.1, < 10.1.4 rev. 011974 PRE"]}],"description":{"text":"Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.","provenance":"source","from":"CVE.org"},"summary":{"text":"Sitecore Experience Manager (XM) and Experience Platform (XP) contain a hardcoded user account in the affected versions 10.1 to 10.1.4 rev. 011974 PRE, all of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE. An unauthenticated remote attacker over HTTP can use this built-in account to access the administrative API, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:49Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.55874,"percentile":0.99041,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-06-22","exploitedFirstSeen":"2025-06-22","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-34509","date":"2025-06-22"},{"url":"https://www.crowdsec.net/vulntracking-report/june-2025","date":"2025-07-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-14&host_type=src&vulnerability=cve-2025-34509","date":"2025-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-17&host_type=src&vulnerability=cve-2025-34509","date":"2025-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-18&host_type=src&vulnerability=cve-2025-34509","date":"2025-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-21&host_type=src&vulnerability=cve-2025-34509","date":"2025-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-14&host_type=src&vulnerability=cve-2025-34509","date":"2025-12-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-16&host_type=src&vulnerability=cve-2025-34509","date":"2025-12-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-18&host_type=src&vulnerability=cve-2025-34509","date":"2026-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-23&host_type=src&vulnerability=cve-2025-34509","date":"2026-01-23"}],"evidenceTotal":79,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Cache Me If You Can (Sitecore Experience Platform Cache Poisoning.","url":"https://otx.alienvault.com/pulse/68b29ae275957ae526469bef","created":"2025-08-30"},{"name":"Is b For Backdoor? Pre-Auth RCE Chain In Sitecore Experience Platform","url":"https://otx.alienvault.com/pulse/6855245bd889bb00859d26fa","created":"2025-06-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"}],"references":[{"url":"https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/","tags":["third-party-advisory","exploit","technical-description"]},{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-18524","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18524","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-34509","name":"Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials","severity":"high","path":"http/cves/2025/CVE-2025-34509.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34509.yaml"}],"provenance":"source"},"exploitRefs":["https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/"],"flow":[],"timeline":[{"date":"2025-06-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-34509","provenance":"source"},{"date":"2025-06-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-34509","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 495 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9904"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}