CVE-2025-34509
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Sitecore XM and XP Hardcoded Credentials
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Experience Manager
- Vendor
- Sitecore
- Product
- Experience Manager
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.4 | affected | custom | 10.4.1 rev. 011941 PRE | Unavailable | None listed |
| 10.3 | affected | custom | 10.3.3 rev. 011967 PRE | Unavailable | None listed |
| 10.1 | affected | custom | 10.1.4 rev. 011974 PRE | Unavailable | None listed |
Experience Platform
- Vendor
- Sitecore
- Product
- Experience Platform
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.4 | affected | custom | 10.4.1 rev. 011941 PRE | Unavailable | None listed |
| 10.3 | affected | custom | 10.3.3 rev. 011967 PRE | Unavailable | None listed |
| 10.1 | affected | custom | 10.1.4 rev. 011974 PRE | Unavailable | None listed |