CVE-2025-34509CWE-798

Sitecore XM and XP Hardcoded Credentials

High · published June 17, 2025

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

56%

Percentile

99.0

In the wild

Unconfirmed

What it is

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.55874 · 99.0th percentile
Weakness: CWE-798 · Use of Hard-coded Credentials
Published: 2025-06-17T18:20Z

EPSS history

Timeline

17 JUN 18:20Z
Sitecore XM and XP Hardcoded Credentials
cvelistv5