Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
CVE-2025-34509
CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-798
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
sitecore experience commerce
sitecore experience manager
sitecore experience platform
sitecore managed cloud
References
- labs.watchtowr.com Exploit, Third Party Advisory
- support.sitecore.com Vendor Advisory