CVE entry · CVE-2025-2746
CVE-2025-2746: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
- Actively exploited: added to CISA’s KEV catalog on October 20, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 10, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Kentico Xperience CMS, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (devnet.kentico.com)
- NVD entry (NIST)
- CISA KEV catalog