Dashboard / CVE-2025-34509

CVE-2025-34509

HIGH
ACT NOW Priority: 4.19 BB Relevance: 85/100
Published: 2025-06-17 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Weakness Classification (1)

Affected Software (21)

VendorProductVersion
Sitecore Experience Manager 10.4 < 10.4.1 rev. 011941 PRE
Sitecore Experience Manager 10.3 < 10.3.3 rev. 011967 PRE
Sitecore Experience Manager 10.2 < 10.3
Sitecore Experience Manager 10.1 < 10.1.4 rev. 011974 PRE
Sitecore Experience Manager 10.4 < 10.4.1 rev. 011941 PRE
Sitecore Experience Manager 10.3 < 10.3.3 rev. 011967 PRE
Sitecore Experience Manager 10.2 < 10.3
Sitecore Experience Manager 10.1 < 10.1.4 rev. 011974 PRE
Sitecore Experience Platform 10.4 < 10.4.1 rev. 011941 PRE
Sitecore Experience Platform 10.3 < 10.3.3 rev. 011967 PRE
Sitecore Experience Platform 10.2 < 10.3
Sitecore Experience Platform 10.1 < 10.1.4 rev. 011974 PRE
Sitecore Experience Platform 10.4 < 10.4.1 rev. 011941 PRE
Sitecore Experience Platform 10.3 < 10.3.3 rev. 011967 PRE
Sitecore Experience Platform 10.2 < 10.3
Sitecore Experience Platform 10.1 < 10.1.4 rev. 011974 PRE
sitecore experience_commerce 9.0 – 10.4
sitecore experience_manager 9.0 – 10.4
sitecore experience_platform 9.0 – 10.4
sitecore experience_platform 10.4
sitecore managed_cloud -

References & Advisories (2)

Bug Bounty Relevance

85 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ High exploitation probability

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

55.87%
Raw Score 0.558740
Percentile 99.0%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links