{"id":"CVE-2025-34509","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-34509","generatedAt":"2026-10-28T00:20:48.093Z","title":"011941 PRE contain a hardcoded user account.","description":"Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.","published":"2025-06-17T19:15:31.000Z","lastModified":"2026-06-17T09:14:03.000Z","status":"Modified","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-798"],"affected":["sitecore/experience commerce","sitecore/experience manager","sitecore/experience platform","sitecore/managed cloud"],"epss":{"score":0.55874,"percentile":0.99038,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 55.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/","tags":["Exploit","Third Party Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667","tags":["Vendor Advisory"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-34509","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}