CVE-2025-2746

CVE-2025-2746 is a critical authentication bypass vulnerability affecting Kentico Xperience versions up to 13.0.172. It allows an attacker to bypass authentication by exploiting how the Staging Sync Server handles empty SHA1 usernames in digest authentication, granting control over administrative objects. This vulnerability carries a CVSS score of 9.8 (Critical), indicating it can be exploited remotely with low complexity and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 100/100, and its EPSS score is exceptionally high, suggesting a significant likelihood of exploitation. The vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog and recent warnings. While no Metasploit or ExploitDB modules are available, Nuclei templates exist for detection, and there is significant community discussion and media coverage surrounding its active exploitation.