Intel

CVE-2026-7312

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 t… (CVE-2026-7312)

criticalEPSS 0.4%

Description

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

Source: BSI_CSAFBSINVDCVEORGCVELISTV5

Metrics

Severity
critical
Priority score
100.11
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
10.0
Source: cna-v3
CVSS v3
10.0
CVSS v4
—
EPSS percentile
37.1 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-06-02 14:17 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-22 19:10 UTC· nvd@nist.gov
    • Translation: Title: Sitefinity de Progress Software, Description: CWE?522: Credenciales Insuficientemente Protegidas en servicios web en la versión de Progress Sitefinity desde la 14.0.7700 hasta la 14.4.8152, y de la 15.0.8200 hasta la 15.0.8234, y de la 15.1.8300 hasta la 15.1.8335, de la 15.2.8400 hasta la 15.2.8441, de la 15.3.8500 hasta la 15.3.8531, y de la 15.4.8600 hasta la 15.4.8630 permite a un atacante remoto no autenticado obtener credenciales en texto plano utilizadas para conectarse al servicio Sitefinity Insight. La explotación exitosa requiere integración activa con Sitefinity Insight y una configuración del sitio no predeterminada.

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • progress

    sitefinity14.0.7700 – 14.4.8152

  • progress

    sitefinity15.0.8200 – 15.0.8234

  • progress

    sitefinity15.1.8300 – 15.1.8335

  • progress

    sitefinity15.2.8400 – 15.2.8441

  • progress

    sitefinity15.3.8500 – 15.3.8531

  • progress

    sitefinity15.4.8600 – 15.4.8630

References & sources

Linked advisories

IDCVE-2026-7312