Actively exploited · Published Mar 24, 2025 · Assigned by VulnCheck
CVE-2025-2746Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Critical 9.8 Exploited
In plain English
A critical-severity authentication bypass in Xperience from Kentico. Attackers are actively exploiting it in the wild (listed by CISA on October 20, 2025). The chance it is exploited in the next 30 days is estimated at 74.1% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 10, 2025.
Official description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Affected products (as reported)
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ technical-description, exploit
- https://devnet.kentico.com/download/hotfixes vendor-advisory, patch
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 exploit
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 government-resource