erroneo.us
Search all guides⌘K

Security Digest · Jan 30, 2025 · Vulnerability · Web framework

Kentico Xperience: Exploited Staging Service Auth Bypasses

Two auth bypasses in Kentico Xperience 13's Staging Service (CVE-2025-2746, -2747) give attackers admin control. Fixed in 13.0.173/13.0.178; exploited, in KEV.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Check exposure

Only sites with the Staging Service enabled under username/password authentication were ever exposed, and hotfixes shipped in early 2025, so confirm your hotfix level and staging settings and hunt only where an old, staging-enabled server faced the internet.

Who must act: Operators of Kentico Xperience 13 below hotfix 13.0.178 (or version 12) with the Staging Service enabled using user name and password authentication.

Who can relax: Sites on 13.0.178 or later, sites with staging disabled (the default), and sites using X.509 staging authentication.

Affected
Kentico Xperience 13.0.172 and earlier (CVE-2025-2746)
Kentico Xperience 13.0.177 and earlier per Kentico; the CVE record says through 13.0.178 (CVE-2025-2747)
Only with the Staging Service enabled and set to user name and password authentication
Version 12 believed affected by watchTowr (not tested)
Fixed in
Hotfix 13.0.173 (CVE-2025-2746)
Hotfix 13.0.178 (CVE-2025-2747 and the post-auth staging RCE)
Latest hotfix recommended (13.0.218 as of Oct 22, 2026)
CVSS
9.8 (v3.1, CNA)
EPSS
97.2% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the installed hotfix version of every Kentico Xperience 13 instance.
  2. Apply the latest cumulative hotfix (at least 13.0.178), following Kentico's hotfix instructions for staging changes.
  3. If you do not use staging, deny all access to Staging/SyncServer.asmx in /CMS/CMSPages/Web.config.
  4. If you do use staging, switch to X.509 authentication and allow SyncServer.asmx only from your source servers.
  5. Review admin users, roles and recently changed objects, and search the web root for unexpected .aspx files.

How to check if you are affected or compromised

  • Select-String -Path C:\inetpub\logs\LogFiles\*\*.log -Pattern 'SyncServer.asmx' and look for callers that are not your staging source servers
  • Unexpected .aspx or other script files in media library folders or elsewhere under the web root
  • Kentico event log entries for staging tasks, users or objects nobody on your team created
  • Run watchTowr's detection artifact generators against your own site to confirm the bypasses are closed

What happened#

Kentico Xperience is a .NET content management and digital experience platform. Its Staging Service, /CMSPages/Staging/SyncServer.asmx, lets one instance push content and objects to another. It is off by default. When it is enabled with "user name and password" authentication, it relies on Microsoft's obsolete WSE 3.0 library. Piotr Bazydło of watchTowr found two ways past it, described in a March 17, 2025 write-up:

  • CVE-2025-2746: for an unknown username, Kentico's token check returned an empty password instead of failing. WSE3 then accepted a digest built from that empty password, so an attacker only needed a nonce and a timestamp. Kentico fixed it in hotfix 13.0.173 on January 30, 2025.
  • CVE-2025-2747: if the request leaves out the password element entirely, WSE3 treats it as "SendNone" and verification passes. Up to 13.0.172 any username works. From 13.0.173 to 13.0.177 the attacker needs a valid staging username. Fixed in 13.0.178 on March 6, 2025.

Either bypass gives administrative control of the Staging API, which Kentico says "can be misused to gain complete control over the Xperience instance". watchTowr also chained a post-auth path traversal in staged media files, fixed in the same 13.0.178 hotfix, to write an ASPX web shell. That makes the chain pre-auth RCE.

CISA added both CVEs to KEV on October 20, 2025, with a November 10 deadline. No public report has described the attacks or named who carried them out as of Oct 23, 2026.

Who is affected#

Kentico Xperience 13 below 13.0.173 is exposed to both bugs, and 13.0.173 through 13.0.177 to CVE-2025-2747. In both cases staging must be enabled with user name and password authentication. X.509 is not affected. Kentico's hotfix list says CVE-2025-2747 was found in 13.0.177 and lower. The CVE record and VulnCheck say "through 13.0.178". The safe answer is the latest hotfix, 13.0.218 as of October 22, 2026. watchTowr believes version 12 is affected too. Both CVEs carry a CVSS 3.1 score of 9.8 (CVE record, NVD).

Do you really need to act?#

Most sites were never exposed, because staging is off by default. Sites that sync content between environments with password authentication were exposed, and so were their production targets. The fixes are more than 18 months old, so for most this is a check rather than a scramble. An older, staging-enabled server that faced the internet deserves a real hunt, because the chain ends in a web shell.

What to do now#

  1. Check each instance's hotfix version in the administration interface or the Kentico Xperience Installation Manager.
  2. Apply the latest cumulative hotfix, at least 13.0.178. Read Kentico's hotfix instructions, because 13.0.178 and 13.0.180 changed staging behavior.
  3. If you do not use staging, block the endpoint: in /CMS/CMSPages/Web.config, set the <location path="Staging/SyncServer.asmx"> authorization to <deny users="*" />.
  4. If you do use staging, switch to X.509 authentication and allow SyncServer.asmx only from your source servers.
  5. On version 12, ask Kentico whether a fix exists for your version, or upgrade to a hotfixed version 13.

How to tell if you were hit#

Search IIS logs for staging calls, for example Select-String -Path C:\inetpub\logs\LogFiles\*\*.log -Pattern 'SyncServer.asmx'. Any caller that is not one of your staging source servers is suspicious. Look for .aspx files in media library folders or elsewhere under the web root that nobody deployed. Check Kentico's event log for staging tasks, users or objects nobody on your team created. If you find any of these, treat the server as compromised and rotate its database and service credentials.

Timeline#

  • — watchTowr reports the first bypass to Kentico.
  • — Hotfix 13.0.173 fixes CVE-2025-2746.
  • — Hotfix 13.0.178 fixes CVE-2025-2747 and the post-auth RCE.
  • — watchTowr publishes the research.
  • — Both CVEs are published.
  • — CISA adds both to KEV (due Nov 10).

Vulnerability records

  • CVE-2025-2746 · KEV 2025-10-20 · An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames…
  • CVE-2025-2747 · KEV 2025-10-20 · An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Kentico — Kentico Xperience 13 hotfixes and security bugs devnet.kentico.com
  2. watchTowr Labs — Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS labs.watchtowr.com
  3. CVE record — CVE-2025-2746 cve.org
  4. CVE record — CVE-2025-2747 cve.org
  5. NVD — CVE-2025-2746 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-2746 cisa.gov
  7. VulnCheck — Kentico Xperience Staging Sync Server None password type authentication bypass vulncheck.com