CVE-2025-2746

Kentico Xperience

Published 24 Mar 2025 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, vulncheck.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 20 Oct 2025, with a remediation deadline of 10 Nov 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

References

devnet.kentico.com/download/hotfixes · Patch
github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 · Third Party Advisory
labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ · Exploit, Third Party Advisory
www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass · Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 · US Government Resource