CVE-2025-2747

CVE-2025-2747 is a critical (CVSS 9.8) authentication bypass (CWE-288) in Kentico Xperience CMS, caused by flawed password handling in the Staging Sync Server component for servers configured with the "None" authentication type, affecting versions through 13.0.178. An unauthenticated remote attacker who can reach the Staging Sync Server endpoint can bypass authentication and take control of administrative objects; public research (WatchTowr Labs) shows the flaw can be chained into a pre-authentication remote code execution chain. No privileges or user interaction are required, so any internet-reachable instance of the sync service is directly exposed. All Kentico Xperience deployments running version 13.0.178 or earlier that have the Staging Sync Server enabled are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20, indicating active in-the-wild exploitation, and EPSS assigns a 92.5% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade Kentico Xperience to a release newer than 13.0.178 (apply the latest vendor-patched 13.0 refresh) and verify in the staging configuration that no server entries are defined with the "None" authentication type, which triggers the bypass. If patching is delayed, restrict network access to the Staging Sync Server endpoint (e.g., firewall it to trusted staging peers only) and review access logs for unauthenticated requests to the sync service. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing by the required due date.