CVE-2025-2746

The vulnerability (CWE-288) consists of improper handling of empty SHA1 usernames during the digest authentication process in the Staging Sync Server component. An attacker without any permissions can send a crafted request with an empty username, which will be incorrectly accepted by the password verification mechanism. As a result, the server bypasses proper identity verification and grants access to protected administrative resources.

Successful exploitation of the vulnerability allows an unauthenticated attacker to remotely take control of Kentico Xperience administrative objects, which may lead to complete compromise of confidentiality, integrity, and availability of the CMS system.

The hotfix available from the vendor at https://devnet.kentico.com/download/hotfixes should be applied immediately, updating the system above version 13.0.172. Due to confirmed active exploitation and inclusion in the CISA KEV catalog, patch deployment should be treated as a priority.

Kentico Xperience in versions up to and including 13.0.172.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.