UpHeron
All vulnerabilities

Servers and applications

CVE-2025-34509

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Severity
High 7.5
Published
17 Jun 2025
Last changed
29 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.4
Sources
NVD

Affected software

SoftwareAffected versions
Sitecore Experience PlatformServers and applications · cpe:a:sitecore:experience_manager
  • From 9.0 up to 10.4
Sitecore Experience PlatformServers and applications · cpe:a:sitecore:experience_platform
  • From 9.0 before 10.4
  • Version 10.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-34509
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-34509