A chain of serious security vulnerabilities has been discovered in the Sitecore Experience Platform (XP), a popular system used by many businesses to manage their websites and digital content. These flaws are critical because they could allow attackers to completely take over a server running Sitecore XP without needing any password or login credentials beforehand. Security researchers have detailed these issues, emphasizing the urgent need for companies using affected versions to patch their systems immediately.
Contents
The core issue lies in a combination of flaws that create a path for attackers to gain unauthorized access and run their own code on the server. If your organization uses Sitecore XP, understanding these vulnerabilities and applying the available patches is crucial to protect your data and operations.
What Happened?
Researchers at watchTowr uncovered a sequence of three distinct vulnerabilities within Sitecore XP versions 10.1 through 10.4. By chaining these issues together, an attacker can bypass standard security measures and execute malicious code on the server. This means they could potentially steal data, disrupt services, or install malware.
Sitecore is a widely used enterprise Content Management System (CMS) that powers the online presence for thousands of organizations, including major banks, airlines, and global corporations. This widespread use means the potential impact of these vulnerabilities is significant.
How the Attack Chain Works
The attack chain leverages a few weaknesses:
A Hidden User with a Simple Password
The first step exploits a built-in internal user named sitecoreServicesAPI. This user account had a hardcoded, easy-to-guess password: “b”. While this user isn’t an administrator and has no assigned roles in the traditional sense, the researchers found a way to authenticate using this account through an alternate login path (/sitecore/admin). This bypass worked because Sitecore’s backend login checks weren’t fully applied in certain contexts. Successfully authenticating this way provides the attacker with a valid session cookie, granting them a basic level of authenticated access to parts of the system that are usually protected.
Abstract image representing a digital breach or hacker access to a system like Sitecore.
Tricking the System with a “Zip Slip” File
With a basic authenticated session, the attacker can then exploit a second vulnerability found in Sitecore’s Upload Wizard. This flaw is known as a “Zip Slip” vulnerability. When uploading a ZIP file through the wizard, an attacker can include malicious file paths inside the archive – for example, a path like //../webshell.aspx. Because Sitecore didn’t properly check or “sanitize” these paths, the system could be tricked into writing the malicious file outside the intended upload folder and directly into the server’s public webroot directory.
Uploading a file like webshell.aspx to the webroot allows the attacker to execute code remotely through a web browser. A webshell is a small script or application that provides a command-line interface via the web, giving the attacker control over the server.
An Even Easier Path with PowerShell Extensions
A third vulnerability makes exploitation even simpler if the Sitecore PowerShell Extensions (SPE) module is installed (which is common, often bundled with Sitecore Experience Accelerator, or SXA). This specific flaw allows an attacker to upload any file to any location they choose on the server, bypassing checks on file types or where the file should be saved. This provides a more direct and reliable way to upload a webshell or other malicious code and achieve Remote Code Execution (RCE).
Remote Code Execution (RCE) is exactly what it sounds like – the ability for someone to run commands on your computer or server from a different location over the internet.
Who is Affected and How Bad Is It?
These vulnerabilities impact Sitecore XP versions 10.1, 10.2, 10.3, and 10.4.
WatchTowr’s analysis identified over 22,000 Sitecore instances publicly accessible online. While not all of these may be running the vulnerable versions or configurations, it highlights a significant number of potential targets. The fact that Sitecore is used by many high-profile organizations amplifies the risk.
“Sitecore is deployed across thousands of environments, including banks, airlines, and global enterprises — so the blast radius here is massive,” stated watchTowr CEO Benjamin Harris. He emphasized the severity, adding, “If you’re running Sitecore, it doesn’t get worse than this.”
Patches Are Available – But Act Fast
Sitecore released security patches to address these issues back in May 2025. However, the technical details and official identifiers (CVE IDs) for the vulnerabilities were kept confidential until June 17, 2025. This delay was intended to give customers time to apply the patches before the vulnerabilities became public knowledge, reducing the window for attackers to exploit them.
Now that the details are public, the risk of real-world attacks is considered imminent. The watchTowr researchers have published technical information sufficient for skilled attackers to understand and replicate the exploit chain.
What You Need to Do Now
If your organization uses Sitecore XP versions 10.1 through 10.4, you must take immediate action:
- Patch Immediately: Apply the official security patches released by Sitecore for your specific version. This is the most critical step.
- Rotate Credentials: As an extra precaution, change the passwords for any service accounts or built-in users, especially the
sitecoreServicesAPIuser if it wasn’t disabled or modified previously.
While there is no public evidence of these specific vulnerabilities being exploited in the wild yet, the high-risk nature and the public availability of technical details mean the threat level is extremely high. Do not delay patching.
Managing patches across an enterprise can be complex. For insights into how modern IT teams streamline this process, explore resources on automating patch management.
- Related: New Veeam RCE flaw lets domain users hack backup servers
- Related: Trend Micro fixes critical vulnerabilities in multiple products
- Related: Exploit details for max severity Cisco IOS XE flaw now public
