CVE-2025-2746

Description

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

References

• https://www.cnvd.org.cn/flaw/show/CNVD-2026-05134
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2746
• https://devnet.kentico.com/download/hotfixes
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2025-2746
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8008
• https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
• https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
• https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass