CVE-2025-2747Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Known exploited — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
CISA confirmed this vulnerability is used in real attacks on 20.10.2025. Remediation deadline for US federal agencies: 10.11.2025.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://devnet.kentico.com/download/hotfixes ; https://nvd.nist.gov/vuln/detail/CVE-2025-2747
Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ technical-descriptionexploitExploitThird Party Advisory
- https://devnet.kentico.com/download/hotfixes vendor-advisorypatchPatch
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 exploitThird Party Advisory
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass third-party-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2747 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*≤ 13.0.178