Sitecore

A chain of vulnerabilities in the Sitecore Experience Platform (XP) allows attackers to perform remote code execution (RCE) without authentication. These vulnerabilities affect Sitecore XP versions 10.1 through 10.4. The pre-auth RCE chain consists of three distinct vulnerabilities, including a hardcoded password for an internal user, a Zip Slip flaw in the Upload Wizard, and a flaw in the Sitecore PowerShell Extensions (SPE) module. Over 22,000 publicly exposed Sitecore instances are at risk, highlighting a significant attack surface. Though there is no public evidence of exploitation, the risk of real-world abuse is imminent.

Source: https://www.bleepingcomputer.com/news/security/sitecore-cms-exploit-chain-starts-with-hardcoded-b-password/

TPRM report: https://scoringcyber.rankiteo.com/company/sitecore

"id": "sit639061725",
"linkid": "sitecore",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Software',
                        'name': 'Sitecore',
                        'size': 'Over 22,000 publicly exposed instances',
                        'type': 'Enterprise CMS'}],
 'attack_vector': 'Pre-auth RCE chain',
 'date_publicly_disclosed': '2025-06-17',
 'description': 'A chain of Sitecore Experience Platform (XP) vulnerabilities '
                'allows attackers to perform remote code execution (RCE) '
                'without authentication to breach and hijack servers.',
 'impact': {'systems_affected': 'Sitecore XP versions 10.1 through 10.4'},
 'initial_access_broker': {'entry_point': 'Hardcoded password for '
                                          'sitecore\\ServicesAPI'},
 'lessons_learned': 'Rotate credentials and patch immediately.',
 'post_incident_analysis': {'corrective_actions': 'Rotate credentials and '
                                                  'patch immediately.',
                            'root_causes': ['Hardcoded password',
                                            'Zip Slip flaw',
                                            'File upload flaw']},
 'recommendations': 'Rotate credentials and patch immediately.',
 'references': [{'source': 'BleepingComputer'}],
 'response': {'remediation_measures': 'Patches available in May 2025'},
 'title': 'Sitecore Experience Platform (XP) Vulnerabilities Leading to Remote '
          'Code Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': ['Hardcoded password for sitecore\\ServicesAPI',
                             'Zip Slip flaw in Upload Wizard',
                             'File upload flaw in Sitecore PowerShell '
                             'Extensions (SPE) module']}

Sitecore

Google

Veeam

ASUS