Critical severity · published Mar 24, 2025
CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
In wildKEV
9.8
CVSS
74.1%
EPSS
Yes
On KEV
Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)74.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 20, 2025
Federal remediation dueNov 10, 2025
Ransomware campaign useNot known
Affected products
Which versions
XP
Xperience · Kentico
through 13.0.172 · source: vendor, NVD
XC
Xperience CMS · Kentico
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-2746: Kentico Xperience CMS - Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
XCXperience CMSCVE-2025-2746
Oct 20, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2746
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
technical-description
https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
vendor-advisory
https://devnet.kentico.com/download/hotfixes
exploit
https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
third-party-advisory
https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass
More from Xperience
9.8
CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
9.8
CVE-2019-10068
Kentico Xperience Deserialization of Untrusted Data Vulnerability
7.2
CVE-2025-2749
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
9.8
CVE-2025-32370
Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through…
9.8
CVE-2017-17736
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS…