CVE-2025-2746

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Kentico	Xperience	<= 13.0.172

References

https://devnet.kentico.com/download/hotfixesPatch
https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011Third Party Advisory
https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypassThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746US Government Resource

Timeline

Published: Mar 24, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 20, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-274606.8The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physi CVE-2025-274616.8During startup, the device automatically logs in the EPC2 Windows user without requesting a password.CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windo CVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows CVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows CVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executabl CVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2025-274697.5Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ov CVE-2025-27479.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password hand CVE-2025-274707.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over