Firetruck

CVE-2025-2746

KEV

Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability

View CVE record →
Vendor / Project
Kentico
Product
Xperience CMS
Date added
Oct 20, 2025
Due date
Nov 10, 2025
Known ransomware use
Unknown
CWEs
CWE-288

Description

Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes