Kentico Xperience staging flaw CVE-2025-2749 used in attacks; hotfix available
Attackers are using a Kentico Xperience website-management flaw that lets someone with privileged staging access run code on the server. Website owners should ask their provider to install Kentico's latest cumulative hotfix and check for compromise.
Nothing to install on your family's devices: this is website-server software. If your family office or business runs a Kentico Xperience website, ask its provider to install the latest cumulative hotfix and check for an existing compromise; Kentico identifies 13.0.178 as the first fixed version.
What’s happening
CVE-2025-2749 affects Kentico Xperience's staging service, which transfers website content between servers. Someone with privileged staging access can upload files outside their intended folder and potentially run code on the website's server. This concerns organisations running Kentico websites. CISA confirmed exploitation by adding the flaw to its catalogue on 20 April 2026; Recorded Future also included it among vulnerabilities exploited that April. Kentico says versions 13.0.177 and earlier are affected and that hotfix 13.0.178, released on 6 March 2025, fixes the problem. The CVE record instead includes 13.0.178 in its affected range; Kentico's version guidance governs this record. Installing the latest cumulative hotfix avoids relying on that disputed boundary. As at 3 November 2026, CISA still lists exploitation, while ransomware involvement remains unknown. The reviewed reports do not identify victims or establish when attacks began.
- What
- Flaw
- Affects
- Kentico Xperience 13 website-management software
- Affected
- Kentico Xperience 13.0.177 and earlier — media-file staging, according to Kentico
- Fixed in
- Kentico Xperience 13.0.178, according to Kentico; subsequent hotfixes are cumulative
- Since
- 20 Apr 2026
Timeline
- Update
CISA's current catalogue still lists the flaw as exploited and records ransomware use as unknown. The entry does not identify attackers or victims.
- CISA added
CISA added CVE-2025-2749 to its catalogue of vulnerabilities used in attacks, setting a 4 May remediation deadline for US federal civilian agencies.
- Update
Belgium's cybersecurity centre urged organisations to patch and monitor for suspicious activity. It warned that installing an update would not remove an existing compromise.
- Made public
The CVE-2025-2749 record was published with a 7.2 severity score. It lists versions through 13.0.178 as affected, conflicting with Kentico's stated fix boundary.
- New fixFixed
Kentico released hotfix 13.0.178 to fix code execution through media-file staging. Its advisory lists 13.0.177 and earlier as affected.
Sources
- Kentico hotfixes — Post-auth remote code executionKentico · 6 Mar 2025
- CVE-2025-2749 recordCVE Program · 21 Apr 2026
- Multiple Kentico Xperience vulnerabilities can lead to remote code executionCentre for Cybersecurity Belgium · 25 Mar 2025
- April 2026 CVE LandscapeRecorded Future · 9 Oct 2026
- Known Exploited Vulnerabilities catalogue — 3 November 2026CISA · 3 Nov 2026