CVE-2025-2747 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
Attackers can bypass authentication in the Staging Sync Server to gain administrative control over the Kentico Xperience CMS.
- Exploited in the wild
- Since 20 Oct 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2747?
CVE-2025-2747 is a critical authentication bypass vulnerability in Kentico Xperience, published on 24 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Weakness: CWE-288
Which versions are affected by CVE-2025-2747?
It affects 1 product.
Products include Kentico Xperience.
How do I fix CVE-2025-2747?
No fix has been published for CVE-2025-2747 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Nov 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-2747 being exploited?
Yes. Attackers have exploited CVE-2025-2747 in the wild since at least 20 Oct 2025.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Kentico Xperience
Sources
Also known as GHSA-8345-rfq2-7h8q.