Sitecore Experience Platform RCE Vulnerability Advisory (SC2025-004)

Key Information Vulnerability ID SC2025-004 Affected Software Experience Platform Affected Versions 9.2.0 (Initial Release) and above Reference IDs SXA-8122, SXA-8159, PDXP-11460 Release Date July 8, 2025 Last Updated July 11, 2025 Description This advisory reports a medium severity vulnerability (SC2025-004) for which a solution is available. Successful exploitation of the related vulnerability could lead to remote code execution and unauthorized access to information. Affected Products and Impact The vulnerability affects all Experience Platform topologies (XM, XP, XC) from 9.2 Initial Release to 10.4 Initial Release. PaaS solutions and containerized solutions are also affected. Managed Cloud customers running affected Experience Platform versions should follow their documented procedures to apply the appropriate patches. Managed Cloud Premium customers can directly contact their solution engineers for patch installation support. Recommended Actions Sitecore customers and partners are encouraged to review the following information and apply the solution to all affected Sitecore instances. Customers are advised to maintain their environments on supported versions and promptly apply all available security fixes.

Goal Reached Thanks to every supporter — we hit 100%!

Sitecore Experience Platform RCE Vulnerability Advisory (SC2025-004)