CVE-2025-2746

Kentico Xperience CMS versions through 13.0.172 contain a critical (CVSS 9.8) authentication bypass (CWE-288) in the Staging Sync Server component, caused by flawed password handling when digest authentication receives an empty SHA1 username. A remote, unauthenticated attacker can trigger the flaw by sending specially crafted digest authentication requests to the staging sync endpoint, with no user interaction required. Successful exploitation lets the attacker bypass authentication and gain control of administrative objects; public research (WatchTowr) shows the bug is part of a pre-auth remote code execution chain. Any Kentico Xperience deployment at or below version 13.0.172 is affected, with highest risk where the Staging Sync Server is enabled and network-reachable. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20, indicating active exploitation, and EPSS puts its 30-day exploitation probability at 59.1% (99th percentile).

What to do: Upgrade Kentico Xperience to a build newer than 13.0.172 per Kentico's security advisory. Until patched, disable the Staging Sync Server or restrict the endpoint to trusted networks only, and rotate staging sync credentials; review logs for unauthenticated staging-sync requests and unexpected changes to administrative objects. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance for cloud services.