Technical Severity
HIGHCVSS v3.1 Metrics
7.2
/ 10
Minimal Risk
Critical
Vector Specification
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitation Likelihood
EPSS Prediction
13.66
%
Predictive Probability
Percentile Rank
94.3
th
Documented as more likely to be exploited than 94.3% of known CVEs.
Detection Date
Apr 20, 2026
Remediation Due
May 04, 2026
CISA Catalog Active
Threat Analysis
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
Remediation Directive
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.