# CVE-2025-34509: Sitecore - Authentication Bypass

> Live exploitation tracking for CVE-2025-34509 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34509

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.2
- **Public exploit available:** Yes
- **Affected products:** Sitecore Experience Manager, Sitecore Experience Platform
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** cms

## Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

## CrowdSec analysis

Tracked as [CVE-2025-34509](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34509), this vulnerability affects multiple versions of Sitecore Experience Manager (XM) and Experience Platform (XP). A hardcoded user account is present in the software, allowing unauthenticated remote attackers to gain unauthorized access to the administrative API via HTTP. This critical flaw poses a serious risk to systems by potentially exposing sensitive functions to external threat actors.

CrowdSec has been tracking this vulnerability and its exploits since 20th of June 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-34509 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-34509 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed attack attempts focus on URLs containing `/sitecore/api/ssc/auth/login` to compromise the admin panel.

## Timeline

- 2025-06-17: CVE Published. CVE-2025-34509 is published to NVD.
- 2025-06-20: Rule Released. CrowdSec releases a rule to detect CVE-2025-34509 exploitation attempts against the CrowdSec Network.
- 2025-06-29: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34509 for the first time.

## References

- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34509) follows observed exploitation activity for CVE-2025-34509. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.