CVE-2025-2747

The Staging Sync Server component in Kentico Xperience improperly handles password verification for servers configured with the 'None' authentication type. An attacker can exploit this vulnerability (CWE-288 — Authentication Bypass Using an Alternate Path or Channel) without any privileges, remotely and without user interaction. As a result, the authentication mechanism is completely bypassed, giving the attacker access to the administrative interface. According to available references, the vulnerability may be part of a chain leading to remote code execution (RCE).

An attacker gains unauthorized control over CMS administrative objects, which can lead to complete system takeover, content modification, data theft, and potential code execution on the server (RCE).

The hotfix available from the manufacturer at https://devnet.kentico.com/download/hotfixes must be applied immediately. It is recommended to update to a version higher than 13.0.178. Until the patch is deployed, consider restricting network access to the Staging Sync Server component at the firewall level.

Kentico Xperience in versions up to and including 13.0.178.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.