CVE-2025-2747

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 20, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274707.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service overCVE-2025-274715.9Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a netCVE-2025-274725.4Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-274737.5Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.CVE-2025-274746.5Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information ovCVE-2025-274757.0Sensitive data storage in improperly locked memory in Windows Update Stack allows an authorized attacker to elevate privileges locally.CVE-2025-274767.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274778.8Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.CVE-2025-274787.0Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.CVE-2025-274797.5Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.CVE-2025-27486.1The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows CVE-2025-274808.1Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.