PT-2025-12668 · Kentico · Kentico Xperience

Piotr Bazydlo · Published 2025-03-24 · Updated 2025-11-06 · CVE-2025-2746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kentico Xperience versions through 13.0.172

Description An authentication bypass issue exists in Kentico Xperience. This flaw is due to improper handling of empty SHA1 usernames in digest authentication within the Staging Sync Server password management. Successful exploitation allows an attacker to bypass authentication and gain control of administrative objects. This issue is actively exploited in the wild. The vulnerability affects the Staging Sync Server and involves the handling of authentication requests. The username parameter in the authentication process is vulnerable.

Recommendations Update Kentico Xperience to version 13.0.173 or 13.0.178. If updating is not immediately possible, disable the Staging Service to mitigate the risk.

Exploit

Fix

LPE

Authentication Bypass Using an Alternate Path or Channel

Improper Authentication

Weakness Enumeration

CWE-288

CWE-287

Related Identifiers

CVE-2025-2746

Affected Products

Kentico Xperience

References · 30

• 🔥 https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 · Exploit
• 🔥 https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2746 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2746 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 · Note
• https://twitter.com/transilienceai/status/1907409681649487964 · Twitter Post
• https://twitter.com/RedTeamNewsBlog/status/1904305961571102753 · Twitter Post
• https://t.me/cveNotify/139061 · Telegram Post
• https://devnet.kentico.com/download/hotfixes · Patch, Security Note, Vendor Advisory
• https://reddit.com/r/TechNadu/comments/1ocihwg/cisa_adds_5_new_actively_exploited · Reddit Post
• https://twitter.com/0dayPublishing/status/1980286466883310043 · Twitter Post
• https://twitter.com/drbinaryai/status/1981489325511757900 · Twitter Post
• https://twitter.com/cybercronai/status/1904836210654162982 · Twitter Post
• https://twitter.com/SecuriTricks/status/1905018066422857817 · Twitter Post
• https://t.me/cveNotify/136176 · Telegram Post