--- title: "CISA KEV: Kentico CMS Bug Gives Attackers Admin Access Without a Password" url: https://radicalnotion.ai/blog/cisa-kev-kentico-cms-bug-gives-attackers-admin-access-without-a-password-20251218171344 type: article description: "A critical authentication bypass in Kentico Xperience CMS lets attackers log in with only a username, chain to file-write, and execute code. Fixed in 13.0.178; CISA confirms active exploitation since Dec 2024." updated: 2025-12-29 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # CISA KEV: Kentico CMS Bug Gives Attackers Admin Access Without a Password By Radical Notion Team, 2025-12-18 *A critical authentication bypass in Kentico Xperience CMS lets attackers log in with only a username, chain to file-write, and execute code. Fixed in 13.0.178; CISA confirms active exploitation since Dec 2024.* A dusty corner of Kentico’s enterprise-grade content-management system—its Staging Sync Service—is under active attack thanks to a pair of "1990s-style" authentication bugs that let anyone on the network become a CMS admin without supplying a password. The flaw, tracked as **CVE-2025-2747**, carries a CVSS 9.8/10 score and was quietly added to CISA’s Known Exploited Vulnerabilities catalog after researchers saw ransomware crews weaponizing it in the wild. --- ## What Happened Late last year, WatchTowr researcher Piotr Bazydlo was poking at Kentico’s SOAP-based staging interface when he noticed something odd: the service, which uses Microsoft’s long-retired Web Services Enhancements 3.0 (WSE3) library, would accept a WS-Security UsernameToken that contained only a username—no password required. Digging deeper, he realized WSE3 returns an empty password string for any non-existent account and that Kentico’s verification logic cheerfully treats an empty password as valid. A second variant (patched in hotfix 173 but still bypassable) accepts a password-digest computed over an empty secret, producing the same result. With staging privileges in hand, Bazydlo then abused a path-traversal quirk in the media-upload API to write an ASPX webshell anywhere on the web root, completing an unauthenticated remote-code-execution chain. Public proof-of-concept code was released March 17; within days CISA flagged "generic ransomware activity" abusing the bug. --- ## Understanding the Vulnerability Think of the Staging Service as a side door reserved for content editors. Instead of a key, it relies on an older electronic keypad (WSE3). If you type any name and hit Enter without a code, the keypad still buzzes you in. Once inside, you reach a storage room (media library) whose file cabinet accepts a folder path. Append `../../inetpub/wwwroot/shell.aspx` and the cabinet dutifully places your file outside the protected media directory. **Simplified attack flow:** 1. POST to `https://site/CMSPages/Staging/SyncServer.asmx` with a SOAP envelope containing: \ \DoesNotExist\ \