Exploited vulnerability

CVE-2025-2746

TLP:CLEAR

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

Facts

Vendor: Kentico
Product: Xperience CMS
CVSS: 9.8
EPSS (probability of exploitation within 30 days): 74.1 %
On CISA's Known Exploited Vulnerabilities list since: 20 October 2025
First known exploitation: 20 October 2025
CISA's deadline for US federal agencies: 10 November 2025
Weakness: CWE-288
First seen by Risk Letters: 20 October 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD