Actively exploited in the wild
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Kentico - Xperience CMS · Listed in the CISA KEV since 2025-10-20. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-2746
CriticalCVSS 9.8KEVSummary
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.172.
Risk Assessment
An attacker can gain unauthorized access to administrative objects, potentially leading to compromise of system integrity and confidentiality.
Recommendation
Upgrade Kentico Xperience to a version newer than 13.0.172 and apply security patches from the vendor.
Other vulnerabilities in Kentico Xperience
See all- CVE-2025-2747CriticalActively exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.178.
- CVE-2020-36890High
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
Original NVD description (English source)
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.