CVE-2025-2747
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Published Mar 24, 2025 · updated Jun 17, 2026 · Kentico Xperience CMS
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2025 · Catalog
Detected
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Oct 20, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Nov 10, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Nov 10, 2025
Affected
- cpe kentico/xperienceversion unspecified
- vendor Kentico Xperience CMSversion unspecified
Sources
- CISA KEVCVE-2025-2747
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
cisa.gov - CVE.orgCVE-2025-2747
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-2747
30-day exploitation probability 97.2%
first.org - NIST NVDCVE-2025-2747
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperien
nvd.nist.gov