CVE-2025-34509: Sitecore XM/XP hardcoded account exposes admin API

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote access to an administrative API with a 7.5 CVSS score and very high EPSS, though no KEV listing or confirmed ransomware use.

What it is

Sitecore Experience Manager and Experience Platform ship with a hardcoded user account across the listed 10.1 through 10.4.1 builds. Because the credential is static and reachable over HTTP, anyone who knows it can authenticate to the administrative API without prior access. The flaw matters because it turns a public-facing CMS into an unauthenticated administrative entry point.

Impact

An attacker gains authenticated access to Sitecore's administrative API, which the CVSS vector scores as high confidentiality impact. The record does not state whether that access extends to code execution or data modification, so those outcomes should not be assumed.

Attack surface

Reachable remotely over HTTP with no authentication and no user interaction, per the CVSS vector AV:N/PR:N/UI:N. The hardcoded account is used directly against the administrative API, so no phishing or local foothold is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.55874 (99th percentile) and a third-party reference is tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Apply the Sitecore vendor advisory KB1003667 fixes for the affected 10.1, 10.2, 10.3 and 10.4 builds.
• If patching cannot be immediate, block external access to the administrative API and restrict it to trusted management networks.
• Rotate or disable the hardcoded account and audit for any authentication events tied to it.
• Review Sitecore logs and API access records for administrative calls from unexpected source addresses.

Detection

• Alert on successful authentication to the Sitecore administrative API from external or non-management IP ranges.
• Search Sitecore and web server logs for the hardcoded account name or its default credential use.
• Baseline normal administrative API callers and flag new or anomalous clients, especially unauthenticated-then-authenticated sequences.
• Monitor for administrative API requests originating from hosts that never previously accessed the application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.