--- title: "Kentico Xperience: Exploited Staging Service Auth Bypasses" url: https://erroneo.us/security/briefs/kentico-xperience-cve-2025-2746-staging-auth-bypass/ description: "Two auth bypasses in Kentico Xperience 13's Staging Service (CVE-2025-2746, -2747) give attackers admin control. Fixed in 13.0.173/13.0.178; exploited, in KEV." type: security-brief section: "Security Digest" date_published: 2025-01-30 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2025-2746", "CVE-2025-2747"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Kentico Xperience: Exploited Staging Service Auth Bypasses **Verdict: Check exposure.** Only sites with the Staging Service enabled under username/password authentication were ever exposed, and hotfixes shipped in early 2025, so confirm your hotfix level and staging settings and hunt only where an old, staging-enabled server faced the internet. - **Who must act:** Operators of Kentico Xperience 13 below hotfix 13.0.178 (or version 12) with the Staging Service enabled using user name and password authentication. - **Who can relax:** Sites on 13.0.178 or later, sites with staging disabled (the default), and sites using X.509 staging authentication. - **Affected:** Kentico Xperience 13.0.172 and earlier (CVE-2025-2746); Kentico Xperience 13.0.177 and earlier per Kentico; the CVE record says through 13.0.178 (CVE-2025-2747); Only with the Staging Service enabled and set to user name and password authentication; Version 12 believed affected by watchTowr (not tested) - **Fixed:** Hotfix 13.0.173 (CVE-2025-2746); Hotfix 13.0.178 (CVE-2025-2747 and the post-auth staging RCE); Latest hotfix recommended (13.0.218 as of Oct 22, 2026) - **CVEs:** CVE-2025-2746, CVE-2025-2747 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Check the installed hotfix version of every Kentico Xperience 13 instance. 2. Apply the latest cumulative hotfix (at least 13.0.178), following Kentico's hotfix instructions for staging changes. 3. If you do not use staging, deny all access to Staging/SyncServer.asmx in /CMS/CMSPages/Web.config. 4. If you do use staging, switch to X.509 authentication and allow SyncServer.asmx only from your source servers. 5. Review admin users, roles and recently changed objects, and search the web root for unexpected .aspx files. ### How to check if you are affected - Select-String -Path C:\inetpub\logs\LogFiles\*\*.log -Pattern 'SyncServer.asmx' and look for callers that are not your staging source servers - Unexpected .aspx or other script files in media library folders or elsewhere under the web root - Kentico event log entries for staging tasks, users or objects nobody on your team created - Run watchTowr's detection artifact generators against your own site to confirm the bypasses are closed ## What happened Kentico Xperience is a .NET content management and digital experience platform. Its Staging Service, `/CMSPages/Staging/SyncServer.asmx`, lets one instance push content and objects to another. It is off by default. When it is enabled with "user name and password" authentication, it relies on Microsoft's obsolete WSE 3.0 library. Piotr Bazydło of watchTowr found two ways past it, described in a [March 17, 2025 write-up](https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/): - **CVE-2025-2746:** for an unknown username, Kentico's token check returned an empty password instead of failing. WSE3 then accepted a digest built from that empty password, so an attacker only needed a nonce and a timestamp. Kentico fixed it in hotfix 13.0.173 on January 30, 2025. - **CVE-2025-2747:** if the request leaves out the password element entirely, WSE3 treats it as "SendNone" and verification passes. Up to 13.0.172 any username works. From 13.0.173 to 13.0.177 the attacker needs a valid staging username. Fixed in 13.0.178 on March 6, 2025. Either bypass gives administrative control of the Staging API, which Kentico says "can be misused to gain complete control over the Xperience instance". watchTowr also chained a post-auth path traversal in staged media files, fixed in the same 13.0.178 hotfix, to write an ASPX web shell. That makes the chain pre-auth RCE. CISA added both CVEs to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746) on October 20, 2025, with a November 10 deadline. No public report has described the attacks or named who carried them out as of Oct 23, 2026. ## Who is affected Kentico Xperience 13 below 13.0.173 is exposed to both bugs, and 13.0.173 through 13.0.177 to CVE-2025-2747. In both cases staging must be enabled with user name and password authentication. X.509 is not affected. Kentico's [hotfix list](https://devnet.kentico.com/download/hotfixes) says CVE-2025-2747 was found in 13.0.177 and lower. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-2747) and [VulnCheck](https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass) say "through 13.0.178". The safe answer is the latest hotfix, 13.0.218 as of October 22, 2026. watchTowr believes version 12 is affected too. Both CVEs carry a CVSS 3.1 score of 9.8 ([CVE record](https://www.cve.org/CVERecord?id=CVE-2025-2746), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-2746)). ## Do you really need to act? Most sites were never exposed, because staging is off by default. Sites that sync content between environments with password authentication were exposed, and so were their production targets. The fixes are more than 18 months old, so for most this is a check rather than a scramble. An older, staging-enabled server that faced the internet deserves a real hunt, because the chain ends in a web shell. ## What to do now 1. Check each instance's hotfix version in the administration interface or the Kentico Xperience Installation Manager. 2. Apply the latest cumulative hotfix, at least 13.0.178. Read Kentico's hotfix instructions, because 13.0.178 and 13.0.180 changed staging behavior. 3. If you do not use staging, block the endpoint: in `/CMS/CMSPages/Web.config`, set the `` authorization to ``. 4. If you do use staging, switch to X.509 authentication and allow `SyncServer.asmx` only from your source servers. 5. On version 12, ask Kentico whether a fix exists for your version, or upgrade to a hotfixed version 13. ## How to tell if you were hit Search IIS logs for staging calls, for example `Select-String -Path C:\inetpub\logs\LogFiles\*\*.log -Pattern 'SyncServer.asmx'`. Any caller that is not one of your staging source servers is suspicious. Look for `.aspx` files in media library folders or elsewhere under the web root that nobody deployed. Check Kentico's event log for staging tasks, users or objects nobody on your team created. If you find any of these, treat the server as compromised and rotate its database and service credentials. ## Timeline - Jan 24, 2025 — watchTowr reports the first bypass to Kentico. - Jan 30, 2025 — Hotfix 13.0.173 fixes CVE-2025-2746. - Mar 6, 2025 — Hotfix 13.0.178 fixes CVE-2025-2747 and the post-auth RCE. - Mar 17, 2025 — watchTowr publishes the research. - Mar 24, 2025 — Both CVEs are published. - Oct 20, 2025 — CISA adds both to KEV (due Nov 10). ## Sources 1. [Kentico — Kentico Xperience 13 hotfixes and security bugs](https://devnet.kentico.com/download/hotfixes) 2. [watchTowr Labs — Bypassing Authentication Like It's The '90s: Pre-Auth RCE Chain(s) in Kentico Xperience CMS](https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/) 3. [CVE record — CVE-2025-2746](https://www.cve.org/CVERecord?id=CVE-2025-2746) 4. [CVE record — CVE-2025-2747](https://www.cve.org/CVERecord?id=CVE-2025-2747) 5. [NVD — CVE-2025-2746](https://nvd.nist.gov/vuln/detail/CVE-2025-2746) 6. [CISA — Known Exploited Vulnerabilities: CVE-2025-2746](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746) 7. [VulnCheck — Kentico Xperience Staging Sync Server None password type authentication bypass](https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass) --- Source page: https://erroneo.us/security/briefs/kentico-xperience-cve-2025-2746-staging-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt