CVE-2025-2747: Kentico Xperience Staging Sync Server authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network authentication bypass, KEV-listed with a near-term due date, and very high EPSS with public exploit code.

What it is

Kentico Xperience through 13.0.178 contains an authentication bypass in the Staging Sync Server password handling when the server password type is set to None. An unauthenticated attacker can bypass authentication and take control of administrative objects, which is severe for any internet-exposed CMS instance.

Impact

An attacker gains administrative control of the CMS without credentials, enabling modification or takeover of site content and administrative objects. Given the CMS context, this can extend to code execution or full site compromise.

Attack surface

Reachable over the network through the Staging Sync Server component with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any Xperience instance exposing the Staging Sync Server is in scope.

Exploitation

Listed in CISA KEV with a 2025-11-10 remediation due date, and EPSS is 0.92488 (99.82 percentile). A public exploit write-up and proof-of-concept repository are referenced, so active exploitation should be assumed.

What to do

• Apply the vendor hotfix for Xperience (see Kentico devnet hotfixes) before the KEV due date of 2025-11-10.
• If patching is not immediately possible, remove internet exposure of the Staging Sync Server and restrict it to trusted management networks.
• Disable or reconfigure Staging Sync Server password handling so the None password type is not used.
• Follow BOD 22-01 guidance for cloud-hosted instances, or discontinue use of the product if mitigations are unavailable.
• Audit administrative accounts and objects for unauthorized changes made before patching.

Detection

• Review Staging Sync Server and web logs for unauthenticated requests to staging/sync endpoints, especially from unexpected source IPs.
• Alert on creation or modification of administrative objects and CMS users outside normal change windows.
• Monitor for the public proof-of-concept request patterns from the watchTowr write-up against Xperience endpoints.
• Correlate CMS audit log entries with network connections to the Staging Sync Server port.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.