CVE-2025-2747criticalunder attackCWE-288

CVE-2025-2747: critical vulnerability in Kentico Xperience

Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass

Published · Updated

Follow this CVE+ Monitor Xperience+ Monitor Xperience CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon594 days
Published on NVDMar 24
1st PoC+594d
CISA KEV+210d
Action required by CISAfederal deadline: 2025-11-10

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Kentico Xperience has a flaw where the Staging Sync Server component fails to properly authenticate connections when a server is configured with a 'None' password type, allowing attackers to bypass authentication and gain administrative control without valid credentials.

Technical detail

The Staging Sync Server component in Kentico Xperience through version 13.0.178 fails to enforce authentication when a server uses the 'None' password type, enabling unauthenticated attackers to bypass authentication mechanisms and manipulate administrative objects through the staging synchronization interface.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Kentico · Xperience
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Kentico Xperience

In the same product, most dangerous first.

CVE-2025-2746CRITICALKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassEPSS 74.1%KEVCVE-2025-2749HIGHKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCEEPSS 4.0%KEVCVE-2025-2748MEDIUMKentico Xperience stored cross-site scripting in multiple-file upload functionalityEPSS 60.6%CVE-2025-32370HIGHCVE-2025-32370EPSS 1.6%CVE-2025-2794HIGHKentico Xperience <= 13.0.180 Unsafe ReflectionEPSS 0.5%CVE-2023-53934HIGHKentico Xperience <= 12.0.98 GetResource Handler Denial of ServiceEPSS 0.4%