Kentico Xperience CMS is subject to a critical authentication bypass vulnerability that is currently being exploited in the wild, posing a severe risk of full system compromise.

This is an authentication bypass flaw (CWE-288) triggered via the Staging Sync Server component. An unauthenticated attacker can manipulate password handling for the server, allowing them to gain control over administrative objects.

Successful exploitation allows an unauthenticated attacker to bypass security controls and gain administrative control over the CMS. This can lead to total system compromise, including unauthorized data access, modification of web content, and potential remote code execution. Given the CVSS score of 9.5 and confirmed active exploitation in the wild, this vulnerability presents an immediate and severe threat to business operations and data integrity.

Immediate Action: Update Kentico Xperience CMS to version 13.0.178 (Hotfix 178) or later immediately.

Proactive Monitoring: Monitor server logs for suspicious POST requests directed at the /CMSPages/Staging/SyncServer.asmx endpoint, particularly those originating from unauthorized or unexpected IP addresses.

Compensating Controls: If patching is not immediately feasible, disable the Staging Service within the CMS settings if it is not strictly required for business operations. Additionally, ensure the Staging Service is configured to use X.509 certificate-based authentication rather than username and password authentication.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up by watchTowr Labs.

Due to the critical nature of this vulnerability, the presence of active exploitation in the wild, and the availability of functional proof-of-concept code, immediate remediation is required. Organizations should prioritize updating to Hotfix 178 or disabling the vulnerable Staging Service component to mitigate the risk of unauthorized administrative access and complete system compromise.