Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-2746

Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

Affects Kentico Xperience 13.0.172 and earlier when the Staging Sync Server is enabled with username/password authentication instead of X.509. Fixed in 13.0.173.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 13.0.173
None on Exploit-DB, Metasploit or GitHub

Summary

Kentico Xperience, a web content management and digital experience platform, is affected through its Staging Sync Server component. An attacker can bypass authentication via the server's digest authentication handling and gain control over administrative objects.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Kentico Xperience

    through 13.0.172

References 4

labs.watchtowr.com

devnet.kentico.com

GitHub · watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011

vulncheck.com

FAQ

Questions about CVE-2025-2746

What does this mean?

The Staging Sync Server's username/password authentication can be bypassed. The research chained this bypass into remote code execution on Xperience CMS deployments.Source: labs.watchtowr.com

Am I affected, and how do I check?

Versions up to and including 13.0.172 are in range. The issue applies only when the Staging (Sync) Service is enabled on the target, which is disabled by default, and it is configured with username/password authentication rather than X.509. To check, confirm the installed version and whether the Staging Service is enabled and which authentication method it uses.Source: labs.watchtowr.com

What should I do about it?

Upgrade to Kentico Xperience 13.0.173 or later, which resolves WT-2025-0006.Source: labs.watchtowr.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data