CVE-2025-2746
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Description
CVE-2025-2746 is a critical authentication bypass vulnerability in Kentico Xperience CMS versions through 13.0.172. The flaw exists in the Staging Sync Server component's digest authentication, where empty SHA1 usernames are improperly handled, allowing an unauthenticated attacker to bypass authentication and gain control over administrative objects. With a CVSS v3.1 base score of 9.8 and an exceptionally high EPSS score of 87.4% (99.4th percentile), this is one of the most likely-to-be-exploited vulnerabilities currently tracked. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| kentico | xperience | <= 13.0.172 |
References
- https://devnet.kentico.com/download/hotfixes(Patch)
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011(Third Party Advisory)
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/(Exploit, Third Party Advisory)
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288 describes a weakness where a system that requires authentication can be bypassed by using an alternative path or channel that does not properly enforce the same authentication requirements. In CVE-2025-2746, the Kentico Xperience Staging Sync Server's digest authentication mechanism fails to properly handle empty SHA1 usernames, creating an alternate path that allows an attacker to authenticate without valid credentials. This type of bypass is particularly dangerous because it completely undermines the access control model of the application.
Impact Analysis
The business impact of CVE-2025-2746 is extremely severe. Confidentiality impact is high because authentication bypass to administrative objects grants the attacker access to all content, user data, configuration settings, and potentially database credentials stored within the CMS. Integrity impact is high as administrative control allows the attacker to modify website content, create malicious pages, alter user permissions, and manipulate the staging synchronization process. Availability impact is high since the attacker could delete content, corrupt the database, or disable the CMS entirely.
The EPSS score of 87.4% (99.4th percentile) makes this one of the highest-probability exploitation targets currently known, meaning active and widespread exploitation is occurring or imminent. CISA's KEV listing confirms real-world exploitation. The ransomware association is listed as unknown, but the ability to gain full administrative control over a CMS that typically hosts public-facing websites creates multiple avenues for further attack, including defacement, data theft, and using the compromised server as a platform for distributing malware. Organizations using Kentico Xperience 13 for their web presence face significant reputational and operational risk if this vulnerability is not addressed immediately.
Exploit Maturity
CVE-2025-2746 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation due date of November 10, 2025. The EPSS score of 87.4% (99.4th percentile) is exceptionally high, placing it among the most exploited vulnerabilities currently tracked. A detailed public exploit and technical analysis has been published by watchTowr Labs, which describes a pre-authentication remote code execution chain that includes this authentication bypass. Supporting materials are available in the watchTowr GitHub repository. VulnCheck has also published an independent advisory confirming the vulnerability. The ransomware usage status is unknown, but given the availability of a complete RCE chain and the high EPSS score, exploitation should be considered widespread.
Remediation
- Apply the latest Kentico Xperience hotfix immediately. Download and install the hotfix from the Kentico DevNet hotfixes page that addresses versions through 13.0.172. Upgrade to at least version 13.0.173 or later.
- Disable or restrict access to the Staging Sync Server. If the Staging Sync Server is not actively used, disable it entirely. If it is required, restrict network access to only trusted staging source servers using firewall rules or IP allowlists.
- Audit CMS administrative accounts and content integrity. Review all administrative user accounts for unauthorized additions or modifications. Inspect website content and configuration for signs of tampering that may indicate prior exploitation.
- Review server logs for authentication bypass indicators. Examine IIS and Kentico application logs for requests to the Staging Sync Server endpoint with unusual or empty authentication parameters that could signal exploitation attempts.
- Consider upgrading to Kentico Xperience 13 latest or migrating to Xperience by Kentico. The modern Xperience platform has a fundamentally different architecture that is not affected by this class of vulnerability. Long-term security improvement may require planning a migration path.
Technical Details
The CVSS v3.1 base score for CVE-2025-2746 is 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) indicates the bypass is straightforward to execute. Privileges Required (PR:N) means no prior authentication is needed. User Interaction (UI:N) confirms no victim action is required. Scope (S:U) is unchanged, and all three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high.
The vulnerability is rooted in the Staging Sync Server's implementation of digest authentication. When processing authentication requests, the server performs SHA1 hashing of the username as part of the credential validation process. However, the implementation fails to properly handle the case where an empty username is provided. An attacker can submit a digest authentication request with an empty SHA1 username hash, which causes the authentication logic to match against a default or null entry, effectively bypassing the authentication check entirely. Once authenticated, the attacker has access to the Staging Sync Server's administrative capabilities, which include full control over content objects, user accounts, and system configuration. Research by watchTowr Labs demonstrated that this bypass can be chained with additional vulnerabilities to achieve full pre-authentication remote code execution on the underlying server.
Frequently Asked Questions
What is CVE-2025-2746?
CVE-2025-2746 is a critical authentication bypass vulnerability in Kentico Xperience CMS versions through 13.0.172. It exploits a flaw in the Staging Sync Server's digest authentication mechanism where empty SHA1 usernames are improperly handled, allowing an unauthenticated attacker to gain administrative control over the CMS.
How likely is CVE-2025-2746 to be exploited?
Extremely likely. The EPSS score of 87.4% places it in the 99.4th percentile, making it one of the most probable exploitation targets currently tracked. Active exploitation has been confirmed by CISA, and a complete pre-authentication RCE chain has been publicly documented by watchTowr Labs.
Is my Kentico Xperience installation affected?
If you are running Kentico Xperience version 13.0.172 or earlier and have the Staging Sync Server component enabled, your installation is affected. Even if the Staging Server is not actively used, it may still be accessible and exploitable if not explicitly disabled.
Can CVE-2025-2746 lead to remote code execution?
Yes. While CVE-2025-2746 itself is an authentication bypass, security researchers have demonstrated that it can be chained with other vulnerabilities to achieve full pre-authentication remote code execution on the server hosting Kentico Xperience. This makes the vulnerability significantly more dangerous than an authentication bypass alone.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.