CVE-2025-2747
Published: 24 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-2747 is an authentication bypass vulnerability in Kentico Xperience, specifically within the Staging Sync Server component's password handling for servers defined with the None type. This flaw allows attackers to bypass authentication and gain control over administrative objects. It affects Kentico Xperience versions through 13.0.178 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-288.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables full bypass of authentication mechanisms, providing the attacker with unauthorized control over administrative objects in the affected system.
Kentico offers hotfixes for this issue via their devnet download portal. Detailed advisories from WatchTowr Labs, VulnCheck, and others outline the vulnerability and recommended mitigations, including patching. The flaw is listed in the CISA Known Exploited Vulnerabilities Catalog.
This vulnerability has seen real-world exploitation, as evidenced by its inclusion in the CISA KEV catalog.
Details
- CWE(s)
- KEV Date Added
- 20 October 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an authentication bypass in the publicly accessible Kentico Xperience Staging Sync Server API, enabling exploitation of a public-facing web application to gain unauthorized administrative control.