VulnerabilityhighExploited in the wild

Hard-Coded 'b' Password in Sitecore XP Sparks Major RCE Risk in Enterprise Deployments

The Hacker Newsby @TheHackersNewsJun 19, 2025 · 03:14 UTC (Jun 19, 2025)3 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-34509 CVE-2025-34510 CVE-2025-34511 CVE-2019-9874 CVE-2019-9875 CVE-2025-27218

Tags: cve-2025-34509 cve-2025-34510 cve-2025-34511 cve-2019-9874 cve-2019-9875 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2019-9874 +1 related CVE CVE-2019-9875	Unauthenticated .NET Deserialization RCE in Sitecore CMS and Experience Platform	9.8 group max	84%	KEVPoC	May 31, 2019 KEV Mar 26, 2025
CVE-2025-27218	Insecure Deserialization RCE in Sitecore Experience Manager (XM) and XP 10.4	5.3	65%		Feb 20, 2025
CVE-2025-34511 +2 related CVEs CVE-2025-34510 CVE-2025-34509	Unrestricted File Upload RCE in Sitecore PowerShell Extensions (SPE)	8.8 group max	30%	PoC	Jun 17, 2025

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Jun 17, 2025 Vulnerability / Enterprise Software Cybersecurity researchers have disclosed three security flaws in the popular Sitecore Experience Platform (XP) that could be chained to achieve pre-authenticated remote code execution. Sitecore Experience Platform is an enterprise-oriented software that provides users with tools for content management, digital marketing, and analytics and reports.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.