Cyber Posture

CVE-2025-2747

CriticalCISA KEVActive ExploitationPublic PoC

Published: 24 March 2025

Published
24 March 2025
Modified
06 November 2025
KEV Added
20 October 2025
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9126 99.7th percentile
Risk Priority 94 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-2747 is an authentication bypass vulnerability in Kentico Xperience, specifically within the Staging Sync Server component's password handling for servers defined with the None type. This flaw allows attackers to bypass authentication and gain control over administrative objects. It affects Kentico Xperience versions through 13.0.178 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-288.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables full bypass of authentication mechanisms, providing the attacker with unauthorized control over administrative objects in the affected system.

Kentico offers hotfixes for this issue via their devnet download portal. Detailed advisories from WatchTowr Labs, VulnCheck, and others outline the vulnerability and recommended mitigations, including patching. The flaw is listed in the CISA Known Exploited Vulnerabilities Catalog.

This vulnerability has seen real-world exploitation, as evidenced by its inclusion in the CISA KEV catalog.

Details

CWE(s)
CWE-288
KEV Date Added
20 October 2025

Affected Products

kentico
xperience
≤ 13.0.178

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an authentication bypass in the publicly accessible Kentico Xperience Staging Sync Server API, enabling exploitation of a public-facing web application to gain unauthorized administrative control.

References