PT-2025-25745 · Sitecore · Sitecore Experience Manager+1

Piotr Bazydlo · Published 2025-02-28 · Updated 2025-12-27 · CVE-2025-34509

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.1.4 rev. 011974 PRE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.2 Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.3 through 10.3.3 rev. 011967 PRE Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.4 through 10.4.1 rev. 011941 PRE

Description The affected software contains a hardcoded user account. Unauthenticated and remote attackers can leverage this account to access the administrative API over HTTP. The hardcoded account is named 'ServicesAPI' with the password 'b'. This allows for a pre-authentication remote code execution chain.

Recommendations Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.1.4 rev. 011974 PRE: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.3 through 10.3.3 rev. 011967 PRE: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.4 through 10.4.1 rev. 011941 PRE: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2026-00300

CVE-2025-34509

Affected Products

Sitecore Experience Manager

Sitecore Experience Platform

References · 21

• 🔥 https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform · Exploit
• https://bdu.fstec.ru/vul/2026-00300 · Security Note
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-34509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34509 · Security Note
• https://twitter.com/empherehq/status/1935393808126197945 · Twitter Post
• https://t.me/purp_sec/785 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1981677079612756030 · Twitter Post
• https://t.me/cveNotify/129815 · Telegram Post
• https://twitter.com/CVEnew/status/1935047585644839054 · Twitter Post
• https://twitter.com/pdnuclei/status/1965233763190718801 · Twitter Post
• https://twitter.com/Cloudflare/status/1952801160626049190 · Twitter Post
• https://t.me/cvetracker/26438 · Telegram Post
• https://twitter.com/r1cksec/status/1935955616620556567 · Twitter Post
• https://twitter.com/chudyPB/status/1976871375194472526 · Twitter Post