VulnerabilityModified

CVE-2025-34509

011941 PRE contain a hardcoded user account.

HIGH 7.5EPSS 55.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 55.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 55.32% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-798
Affected: sitecore/experience commerce · sitecore/experience manager · sitecore/experience platform · sitecore/managed cloud
Source: disclosure@vulncheck.com

References

https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/Exploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.