CVE-2025-2747
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Description
CVE-2025-2747 is a critical authentication bypass vulnerability in Kentico Xperience CMS versions through 13.0.178, closely related to CVE-2025-2746 but exploiting a different flaw in the Staging Sync Server component. This vulnerability abuses the password handling for the server-defined "None" authentication type, allowing an unauthenticated attacker to bypass authentication and control administrative objects. With a CVSS v3.1 base score of 9.8 and an EPSS score of 88.9% (99.5th percentile), it ranks among the most likely-to-be-exploited vulnerabilities in circulation. CISA has added it to the KEV catalog with a remediation deadline of November 10, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| kentico | xperience | <= 13.0.178 |
References
- https://devnet.kentico.com/download/hotfixes(Patch)
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011(Third Party Advisory)
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/(Exploit, Third Party Advisory)
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2747(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-288 describes a condition where a system's authentication can be circumvented through an alternative path or communication channel that does not enforce the same security controls as the primary authentication mechanism. In CVE-2025-2747, the Kentico Xperience Staging Sync Server defines a "None" authentication type for server-to-server communication. The password handling logic for this type fails to enforce proper authentication, creating a bypass path that allows an attacker to gain administrative access without valid credentials. This is the second authentication bypass discovered in the same component, alongside CVE-2025-2746.
Impact Analysis
The business impact of CVE-2025-2747 mirrors the severity of its companion vulnerability CVE-2025-2746, with maximum impact across all security dimensions. Confidentiality impact is high because administrative authentication bypass exposes all CMS content, user data, configuration settings, and potentially database credentials to the attacker. Integrity impact is high as the attacker gains the ability to modify website content, inject malicious scripts, alter user permissions, and manipulate the staging synchronization pipeline between environments. Availability impact is high since administrative control allows the attacker to delete content, corrupt configurations, or take the CMS offline entirely.
The EPSS score of 88.9% (99.5th percentile) is among the highest exploitation probability scores assigned to any currently tracked vulnerability, indicating near-certain active exploitation. CISA's KEV listing provides authoritative confirmation. The ransomware association is listed as unknown, but the full administrative access gained through this bypass provides attackers with multiple pathways for monetization, including data theft, ransomware deployment, and website defacement. Organizations running Kentico Xperience 13 should note that both CVE-2025-2746 and CVE-2025-2747 target the same component, meaning the Staging Sync Server represents a concentrated area of critical risk.
Exploit Maturity
CVE-2025-2747 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2025. The EPSS score of 88.9% (99.5th percentile) is exceptionally high, indicating that this is among the most actively targeted vulnerabilities currently known. A detailed technical writeup and exploit chain has been published by watchTowr Labs, describing a pre-authentication remote code execution chain that incorporates this authentication bypass alongside CVE-2025-2746. Supporting exploit code and analysis are available in the watchTowr GitHub repository. VulnCheck has also issued an independent advisory confirming the vulnerability specifics. The ransomware usage status is unknown, but the combination of public exploit code and an extremely high EPSS score means exploitation should be assumed to be widespread and ongoing.
Remediation
- Apply the latest Kentico Xperience hotfix immediately. Download the hotfix from the Kentico DevNet hotfixes page that addresses versions through 13.0.178. Ensure your installation is updated to at least version 13.0.179 or later.
- Disable the Staging Sync Server if not required. The Staging Sync Server component is the attack surface for both CVE-2025-2746 and CVE-2025-2747. If staging synchronization is not used in your environment, disable this component entirely to eliminate the risk.
- Restrict network access to the Staging Sync Server endpoint. If the staging feature is required, configure firewall rules to allow connections only from known, trusted staging source servers. Block all other network access to the staging endpoint.
- Conduct a comprehensive security audit of the CMS. Review all administrative accounts, content changes, and system configurations for signs of unauthorized access. Pay special attention to any modifications made through the staging synchronization interface.
- Plan migration to a supported platform version. Kentico Xperience 13 has been the target of multiple critical authentication bypass vulnerabilities. Evaluate the feasibility of migrating to the latest Xperience by Kentico platform, which uses a modern architecture not susceptible to these legacy authentication flaws.
Technical Details
The CVSS v3.1 base score for CVE-2025-2747 is 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack Vector (AV:N) indicates remote exploitation over the network. Attack Complexity (AC:L) means the bypass is trivially exploitable. Privileges Required (PR:N) confirms no authentication is needed, and User Interaction (UI:N) means no victim action is required. Scope (S:U) is unchanged. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high, reflecting complete administrative compromise.
The vulnerability targets the Staging Sync Server's authentication type selection logic. The Kentico Xperience Staging Sync Server supports multiple authentication types for server-to-server communication, including a "None" type that is intended for trusted internal environments. The password handling code for the "None" authentication type contains a logic flaw that fails to properly verify the request, allowing an attacker to set the authentication type to "None" and bypass all credential checks. This is distinct from CVE-2025-2746, which exploits empty SHA1 usernames in digest authentication. Together, these two vulnerabilities provide independent paths to bypass authentication on the same component. Research by watchTowr Labs demonstrated that either bypass can be chained with additional deserialization or code execution vulnerabilities in the staging pipeline to achieve full pre-authentication remote code execution on the hosting server.
Frequently Asked Questions
What is CVE-2025-2747?
CVE-2025-2747 is a critical authentication bypass vulnerability in Kentico Xperience CMS versions through 13.0.178. It exploits a flaw in the Staging Sync Server's handling of the "None" authentication type, allowing an unauthenticated attacker to bypass authentication and gain administrative control over the CMS.
How does CVE-2025-2747 differ from CVE-2025-2746?
Both vulnerabilities target the same component (Staging Sync Server) and have the same impact, but they exploit different authentication flaws. CVE-2025-2746 abuses empty SHA1 usernames in digest authentication, while CVE-2025-2747 abuses the "None" authentication type password handling. Both need to be patched independently.
What is the EPSS score for CVE-2025-2747?
The EPSS score is 88.9%, placing it in the 99.5th percentile. This means it has a higher exploitation probability than 99.5% of all tracked vulnerabilities. Combined with its CISA KEV listing, this indicates widespread active exploitation.
Should I patch both CVE-2025-2746 and CVE-2025-2747?
Absolutely. Both vulnerabilities provide independent authentication bypass paths to the same component. Patching only one leaves the other exploitable. Apply all available hotfixes from Kentico and strongly consider disabling the Staging Sync Server if it is not essential to your operations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.