CISA KEV: Kentico CMS Bug Gives Attackers Admin Access Without a Password

Think of the Staging Service as a side door reserved for content editors. Instead of a key, it relies on an older electronic keypad (WSE3). If you type any name and hit Enter without a code, the keypad still buzzes you in. Once inside, you reach a storage room (media library) whose file cabinet accepts a folder path. Append ../../inetpub/wwwroot/shell.aspx and the cabinet dutifully places your file outside the protected media directory.

Simplified attack flow:

1. POST to https://site/CMSPages/Staging/SyncServer.asmx with a SOAP envelope containing:

1. Receive a 200 OK containing staging credentials.
2. Call ProcessSynchronizationTaskData, embedding an ASPX payload in TaskBinaryData and setting librarySubFolderPath to ../../shell.aspx.
3. Browse to /shell.aspx; code runs under the IIS application-pool identity.

Kentico patched the chain in hotfix 13.0.178 released March 6.

Who Is Affected

Staging is enabled with username/password authentication by default on many installations, particularly in load-balanced or multi-environment configurations. Kentico claims over 30,000 sites worldwide; CISA’s KEV entry singles out U.S. state and federal agencies among high-value targets.

Real-World Risk

• Active exploitation observed starting December 20, 2024, per CISA. No specific ransomware family has been named publicly, but incident-response firms tell KrebsOnSecurity the flaw is now a "preferred trampoline" for deploying remote-access tools and exfiltrating customer databases.
• Because the exploit is a single SOAP request, attackers can scan the entire IPv4 space rapidly—leading to opportunistic compromise of forgotten marketing sites that share a corporate Active Directory forest.
• Post-authentication impact equals full CMS and underlying Windows host compromise, allowing theft of admin hashes, credit-card data stored by e-commerce modules, and intellectual-property stored as media files.

What You Should Do

1. Patch immediately to hotfix 13.0.178 (cumulative) via Kentico DevNet (https://devnet.kentico.com/download/hotfixes).
2. If you cannot patch within 24 hours:
3. Hunt for existing compromise:
4. Block external access to /CMSPages/Staging/SyncServer.asmx at the WAF or firewall unless business-critical.

The Bigger Picture

CVE-2025-2747 is the latest reminder that obsolete middleware never truly retires—it just waits for a security researcher (or ransomware gang) to notice. Microsoft deprecated WSE3 in 2009. Yet its remnant code lives inside countless enterprise platforms that layered extra security assumptions on top. When those assumptions break—as they did here—the resulting trust gap spans the entire application stack.

Kentico has pledged to migrate staging communication away from WSE3, but no timeline has been announced. Until then, defenders should treat any product still relying on WSE3 as technical debt with an impending due date.

Bottom line: If you run Kentico Xperience 13 (or the unsupported 12.x line) and haven’t applied hotfix 178, disable staging or upgrade today. The internet’s adversaries already have working exploits—and they’re not knocking politely.

CVE-2025-2747 was assigned a CVSS score of 9.8. Kentico released patches on March 6, 2025. CISA has ordered U.S. federal agencies to remediate by November 10, 2025.