A series of newly disclosed critical vulnerabilities in the Sitecore Experience Platform (XP) have raised alarm across the enterprise technology sector, with security researchers warning that unpatched systems could be exposed to devastating remote code execution (RCE) attacks.
Sitecore, a widely adopted content management system (CMS) used by major enterprises—including banks, airlines, and Fortune 500 companies—now faces urgent calls for immediate patching and credential rotation to prevent potential exploitation on a massive scale.
Chain of Flaws
The vulnerabilities, detailed by security researchers at watchTowr Labs and Assetnote, include a chain of three flaws that, when combined, allow attackers to gain unauthorized access and ultimately execute arbitrary code on affected servers.
The most severe vulnerability, designated CVE-2025-27218, is a pre-authentication remote code execution flaw stemming from unsafe deserialization in the MachineKeyTokenService.IsTokenValid method.
This flaw allows attackers to send malicious payloads via the ThumbnailsAccessToken HTTP header, which are deserialized without proper validation, enabling arbitrary code execution with the privileges of the Sitecore application pool.
This vulnerability affects Sitecore versions up to 10.4 and was patched in version 10.4.1.
In addition to CVE-2025-27218, researchers uncovered a chain of three related vulnerabilities, which include:
- WT-2025-0024 (CVE-2025-XXXXX): Hardcoded credentials for the internal user account sitecore\ServicesAPI, which has a trivially guessable single-character password “b”. This password has been hardcoded in Sitecore installers since version 10.1, creating a significant authentication weakness.
- WT-2025-0032 (CVE-2025-XXXXX): Post-authentication remote code execution via a path traversal vulnerability in the /sitecore/shell/Applications/Dialogs/Upload/Upload2.aspx endpoint. Attackers authenticated as sitecore\ServicesAPI can upload specially crafted ZIP files that unzip web shells into the webroot, enabling full server compromise.
- WT-2025-0025 (CVE-2025-XXXXX): Post-authentication remote code execution via an unrestricted file upload flaw in the Sitecore PowerShell Extension, exploitable through the /sitecore%20modules/Shell/PowerShell/UploadFile/PowerShellUploadFile2.aspx endpoint by the same internal user.
A separate, but equally critical, vulnerability (CVE-2025-27218) was also uncovered, involving unsafe deserialization in the MachineKeyTokenService.IsTokenValid method.
Enterprise Impact and Urgent Mitigation
With over 22,000 Sitecore instances exposed online and the platform’s deep integration into global enterprise infrastructure, the scale of potential attacks is immense.
Security experts warn that successful exploitation could lead to data theft, lateral movement within corporate networks, and significant operational disruption.
Sitecore has released patches addressing these vulnerabilities, and organizations are strongly urged to:
- Apply all available security updates immediately
- Rotate credentials for all internal Sitecore service accounts
- Audit server logs for signs of suspicious activity, especially around the affected endpoints
As attackers are likely to reverse-engineer the fixes and exploit unpatched systems, the window for remediation is rapidly closing.
The Sitecore vulnerabilities serve as a stark reminder of the risks posed by default credentials and insecure coding practices in enterprise software.
Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates
, exposed to devastating remote code execution (RCE) attacks.){kind=link}