Sitecore has 2 CVEs on record between 2021 and 2025. The median CVSS is 8.7 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 50% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —(1)
- Last 90 days
- 0 prev 0
2
Total CVEs
1
Critical
1
CISA KEV
1
Exploited
Worst active — by depth score
Sitecore vulnerabilities
CVEs affecting Sitecore, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2025-34509High· 7.5PoCSitecore XM and XP Hardcoded Credentials
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthentic…
▾ MidnightSitecore · Experience ManagerEPSS 56%via CVEORG
CVE-2021-42237Critical· 9.8CISA KEV0dayPoCSitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is requir…
▾ Hadalsitecore · experience_platformEPSS 98%via NVD