---
id: "CVE-2025-2746"
kind: "vulnerability"
aliases: ["CVE-2025-2746"]
title: "An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Kentico Xperience CMS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "kentico xperience", "fixed": [], "affected": "<= 13.0.172", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "kentico", "package", "self-hosted", "xperience-cms"]
not_affected_if: ["unknown"]
published_at: "2025-03-24T19:15:51+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2746", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2746", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server…

Kentico Xperience CMS has an authentication bypass through an alternate path, letting an attacker reach administrative objects without logging in. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kentico Xperience CMS affected ? fixed ?
- vendor:kentico xperience affected <= 13.0.172 fixed ?

## Fix

Apply the mitigations from the Kentico vendor advisory; if none are available, stop using the product (per CISA guidance). Exact fixed version: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-2746
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-2746

## From the sources

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_