Three confirmed-exploited vulnerabilities in Kentico Xperience CMS all trace back to the same component — the Staging Sync Server — and together they show how a single feature meant to keep content synchronized across environments became a complete pre-authentication path to remote code execution.
| CVE | CVSS | Issue | Added to KEV |
|---|---|---|---|
| CVE-2025-2746 | 9.8 | Auth bypass via empty SHA1 username digest handling | 20 Oct 2025 |
| CVE-2025-2747 | 9.8 | Auth bypass via server-defined None password type | 20 Oct 2025 |
| CVE-2025-2749 | 7.2 | Path traversal and arbitrary file upload leading to RCE | 20 Apr 2026 |
Why three CVEs against one feature is worse than three CVEs against three features
When a vendor's vulnerabilities cluster in a single component rather than scattering across a product, it usually means researchers found a design-level weakness rather than an isolated coding mistake. The Staging Sync Server exists to let a Kentico Xperience instance receive content and configuration pushed from another environment — inherently a trust relationship, and inherently a feature that has to authenticate incoming pushes carefully. Two separate authentication bypass paths — one exploiting how the digest authentication scheme handles an empty SHA1 username, the other exploiting how it handles a server-defined "None" password type — describe an authentication mechanism with more than one way to be told "this request doesn't need real credentials." That is a pattern in how the feature was built, not two unrelated bugs.
CVE-2025-2749 is where this becomes concrete. NVD's description states plainly that it allows "authentication remote code execution" through the Staging Sync Server, which can be made to upload arbitrary data to path-relative locations, resulting in "path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution." Read alongside the two authentication bypass CVEs, this describes an attack chain publicly documented by watchtowr Labs under a title that says the quiet part out loud: pre-auth RCE achieved by chaining authentication bypass into arbitrary file upload. An attacker does not need valid credentials for the first step, and does not need to be creative for the second — the path traversal was the only hurdle standing between an authenticated write primitive and a webshell.
Why the same GitHub advisory research effort logged all three
All three CVEs share the same watchtowr Labs research and the same VulnCheck advisory family, and all three point back to the identical Kentico devnet hotfix page rather than three separate patch releases. That is a strong signal this was one coordinated disclosure covering one vulnerable subsystem, not three independent discoveries submitted months apart. Organizations that patched only the CVE with the highest CVSS score (either of the two 9.8-rated auth bypasses) without also addressing CVE-2025-2749's path traversal would have closed the front door while leaving the file-upload consequence of walking through it unaddressed — the authentication bypass and the RCE outcome are two links in the same chain, and a partial patch against this cluster is a false sense of security.
What to check this week
- Confirm every hotfix from the devnet.kentico.com hotfixes page has been applied, not just the one tied to whichever CVE prompted the initial patch cycle — all three were published together and address the same underlying subsystem.
- Audit whether the Staging Sync Server needs to be internet-reachable at all. A feature designed for environment-to-environment content sync rarely needs to accept connections from the open internet, and restricting its network exposure closes off the entire attack surface these three CVEs depend on.
- Review authentication logs on the Staging Sync Server for empty or malformed username/password fields in digest authentication attempts, which is the specific pattern these bypasses exploit.
- Treat any Kentico Xperience instance through version 13.0.178 as vulnerable until the hotfixes are confirmed installed — that is the version ceiling NVD cites for the most recent of the three CVEs.
A closing note on staging and sync features as an attack surface class
Content management systems increasingly ship built-in staging, sync, or environment-promotion features to reduce the operational burden of manual deployment — convenient for administrators, but each one is effectively an internal API accepting pushes of executable content from a "trusted" source. Kentico's Staging Sync Server is one instance of a broader pattern: any CMS feature whose entire purpose is receiving and applying content updates deserves the same security scrutiny given to a public login form, because from an attacker's perspective, that is functionally what it is.
A final consideration on watchtowr's disclosure title
The research publication covering this chain is explicitly titled around "bypassing authentication like it's the 90s" — a framing worth taking at face value. Digest authentication schemes with edge cases around empty or null credential fields are a known, decades-old class of implementation mistake, and its reappearance in a widely deployed 2025 CMS is a reminder that legacy authentication mechanisms carried forward into modern products need to be re-audited against modern attack tooling, not assumed safe because the scheme itself is old and well-understood.
How Safeguard helps
Safeguard's continuous inventory identifies internet-facing Kentico Xperience deployments and flags when Staging Sync Server functionality remains reachable without the current hotfix level applied, so a three-CVE chain like this one is caught as a single coordinated remediation item rather than three disconnected tickets prioritized by CVSS score alone.
