Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass (CVE-2025-2746)

What is affected, what to do

The CVE-2025-2746 vulnerability is an authentication bypass in Kentico Xperience CMS, allowing attackers to control administrative objects. This vulnerability is actively exploited and listed in the CISA KEV catalog. It affects versions up to 13.0.172 by allowing authentication bypass via empty SHA1 usernames in the Staging Sync Server password handling. Organizations should urgently update to the latest version to mitigate the risk of exploitation.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Kentico Xperience lte *..13.0.172

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every Kentico Xperience 13.x instance, including staging, test and agency-hosted sites. All builds up to and including 13.0.172 are affected. Check the version in the admin UI or via the assembly version of CMS.Core.dll.
   • Apply the hotfix: Install a Kentico hotfix newer than 13.0.172. A patch is available from the vendor — look up the exact hotfix number in the Kentico security advisory. Verify the resulting version on every web farm node.
   • Disable the staging service now if it is not strictly required: Go to Settings → Versioning & Synchronization → Staging and untick "Enable staging service" (settings key CMSStagingServiceEnabled = false). The flaw lives in the Staging Sync Server's password handling.
   • Block the endpoint at the edge: Deny /CMSPages/Staging/SyncServer.asmx on the reverse proxy, WAF or load balancer for all sources except known staging source servers (return 403).
   • Start a compromise assessment: For internet-facing instances, check for:
     • new or modified users with privilege level "Global administrator" (CMS_User),
     • unexpected media or file objects,
     • new .aspx/.ashx/.config files in the web root.
   • Rotate credentials if anything looks off: Reset all CMS admin passwords, the staging service account and the database connection strings in web.config.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: If staging must stay on, switch staging service authentication from username/password to X.509 certificates. The bug affects the password/digest path. Also set a strong, unique staging password.
   • Network segmentation: Allow staging sync only across a dedicated management network or VPN. Enforce an IIS IP allowlist (IP Address and Domain Restrictions) on /CMSPages/Staging/.
   • WAF/IPS rule: Drop SOAP requests to SyncServer.asmx that carry a WS-Security UsernameToken with an empty or missing <Username> element. A Suricata starting point is http.uri; content:"SyncServer.asmx"; nocase; combined with http.request_body; content:"<wsse:Username></wsse:Username>";.
   • Endpoint hardening:
     • Minimise write permissions of the IIS app pool identity on the web root.
     • Remove script handlers from upload and media directories via web.config.
     • Apply AppLocker/WDAC rules restricting child processes of w3wp.exe.
   • IAM/least privilege: Reduce the number of global administrators and scope the CMS database account to its own database only (no sysadmin).
3. 03

   Runbook step 3

   Detection rules

   • IIS access logs: POST requests to /CMSPages/Staging/SyncServer.asmx from IPs outside the staging allowlist. SPL example: index=iis cs_uri_stem="*/CMSPages/Staging/SyncServer.asmx" cs_method=POST NOT c_ip IN (<staging_ips>) | stats count by c_ip, sc_status.
   • Process ancestry (Sysmon EID 1 / EDR): w3wp.exe spawning cmd.exe, powershell.exe, csc.exe or certutil.exe. Sigma shape: ParentImage|endswith: '\w3wp.exe' and Image|endswith: ['\cmd.exe','\powershell.exe'].
   • File creation (Sysmon EID 11): w3wp.exe writing .aspx, .ashx, .asmx or .config files into the Kentico web root or media libraries. This is a classic webshell drop following takeover of admin objects.
   • Kentico application data: Review CMS_EventLog for staging synchronisation events outside planned deployments. Review CMS_User for new global admin accounts or recent UserLastModified changes.
   • Network (Zeek): In http.log, look for SOAP requests to SyncServer.asmx from external addresses. Bursts from a single source point to automated scanning.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

Source: pwn.watch, cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Kentico Kentico Xperience

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• labs.watchtowr.combypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-…Technical description, Exploit, Exploit, Third-party advisory
• devnet.kentico.comKentico advisory: Kentico Xperience CMSVendor advisory, Patch, Patch, pwn-watch
• github.comwatchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011Exploit, Third-party advisory
• vulncheck.comadvisories/kentico-xperience-staging-sync-server-digest-passwor…Third-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746government-resource, US government resource
• pwn.watchpwn.watch: Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)pwn-watch
• NVD (NIST)NVD: CVE-2025-2746pwn-watch
• NVD (NIST)NVD: CVE-2025-2747pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch