Vulnerability record · CVE-2025-2746 · published 24 March 2025
CVE-2025-2746: Kentico Xperience Staging Sync Server authentication bypass
Kentico · Xperience
Kentico Xperience through 13.0.172 mishandles empty SHA1 usernames in digest authentication on the Staging Sync Server, allowing an attacker to bypass authentication. Because the bypass grants control of administrative objects, it exposes the CMS to full compromise.
Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 unauthenticated network authentication bypass with KEV listing, high EPSS, and public exploit code.
What it is
Kentico Xperience through 13.0.172 mishandles empty SHA1 usernames in digest authentication on the Staging Sync Server, allowing an attacker to bypass authentication. Because the bypass grants control of administrative objects, it exposes the CMS to full compromise.
Impact
An unauthenticated attacker gains administrative control of the Kentico Xperience instance, enabling manipulation of administrative objects and content.
Attack surface
Reachable over the network via the Staging Sync Server digest authentication handling; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Listed in CISA KEV with a 30-day EPSS probability of 0.59052 (99th percentile), and a public exploit reference is tagged Exploit, indicating active exploitation.
What to do
- Apply the vendor hotfix from the Kentico DevNet hotfix page for Xperience 13.0.172 and earlier.
- If patching is not immediately possible, restrict network access to the Staging Sync Server to trusted hosts only.
- Follow CISA BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- Review and rotate credentials and administrative accounts on any exposed Xperience instance.
Detection
- Monitor Staging Sync Server authentication logs for digest authentication attempts with empty or malformed usernames.
- Alert on unexpected administrative object changes or new admin accounts in Kentico Xperience.
- Hunt for network connections to the Staging Sync Server endpoint from untrusted or external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-2746 to the Known Exploited Vulnerabilities catalog on 20 October 2025 as "Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 10 November 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://devnet.kentico.com/download/hotfixes | Patch |
| https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 | Third Party Advisory |
| https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 | US Government Resource |
Track CVE-2025-2746 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-2746), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
