Sitecore - Authentication Bypass (CVE-2025-34509)
Description
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
psychologyCrowdSec Analysis
Tracked as CVE-2025-34509, this vulnerability affects multiple versions of Sitecore Experience Manager (XM) and Experience Platform (XP). A hardcoded user account is present in the software, allowing unauthenticated remote attackers to gain unauthorized access to the administrative API via HTTP. This critical flaw poses a serious risk to systems by potentially exposing sensitive functions to external threat actors.
CrowdSec has been tracking this vulnerability and its exploits since 20th of June 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-34509 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34509 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Observed attack attempts focus on URLs containing /sitecore/api/ssc/auth/login to compromise the admin panel.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-06-17 |
| Rule Released | 2025-06-20 |
| CrowdSec First Seen | 2025-06-29 |