CVE-2025-2746: critical vulnerability in Kentico Xperience
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Kentico Xperience has a critical flaw in its Staging Sync Server that allows attackers to bypass password authentication by exploiting how it handles empty usernames in digest authentication. This lets attackers gain administrative access without knowing the correct password.
The vulnerability exists in the digest authentication mechanism of Kentico Xperience's Staging Sync Server, where improper handling of empty SHA1 usernames allows authentication bypass. An attacker can craft a malicious digest authentication request to gain unauthorized administrative access to control sensitive objects, affecting versions through 13.0.172.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.