CVE-2025-34509 Sitecore XM and XP Hardcoded Credentials
Unauthenticated attackers can use hardcoded credentials to access administrative APIs in Sitecore XM and XP, leading to unauthorized control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34509?
CVE-2025-34509 is a high-severity vulnerability in Sitecore Experience Manager, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
Weakness: CWE-798
Which versions are affected by CVE-2025-34509?
It affects 4 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.
How do I fix CVE-2025-34509?
No fix has been published for CVE-2025-34509 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34509 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34509 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Sitecore Experience Manager
- CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2023-35813 Code injection in n/a
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Sources
Also known as GHSA-g93f-92gj-4q4x.