Authentication Bypass Vulnerability in Kentico Xperience from Kentico
CVE-2025-2746

9.8CRITICAL

Key Information:

Vendor

Kentico

Status
Xperience
Vendor
CVE Published:
24 March 2025

Badges

👾 Exploit Exists🟣 EPSS 66%🦅 CISA Reported📰 News Worthy

What is CVE-2025-2746?

An authentication bypass vulnerability in Kentico Xperience enables unauthorized access through flaws in handling empty SHA1 usernames during digest authentication. This weakness allows attackers to potentially gain control over administrative objects, impacting the overall security of systems utilizing Xperience up to version 13.0.172. Ensuring correct authentication practices and updating to the latest versions can mitigate the risks associated with this vulnerability.

CISA has reported CVE-2025-2746

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-2746 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Xperience 0 <= 13.0.172

News Articles

favicon imageSecurity Affairs

U.S. CISA adds Oracle, Windows, Kentico, Apple flaws to its Known Exploited Vulnerabilities catalog

U.S. CISA adds Oracle, Windows, Kentico, and Apple vulnerabilities to its Known Exploited Vulnerabilities catalog.

1 week ago

References

https://labs.watchtowr.com/bypassing-authentication-like-...
technical-descriptionexploit
https://devnet.kentico.com/download/hotfixes
vendor-advisory
https://github.com/watchtowrlabs/kentico-xperience13-Auth...
exploit

EPSS Score

66% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by Security Affairs

  • 🦅

    CISA Reported

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

JSON
.
CVE-2025-2746 : Authentication Bypass Vulnerability in Kentico Xperience from Kentico