CVE-2026-7195
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.
Risk Assessment
An attacker could access user accounts and modify data, leading to data security breaches and loss of trust in the CMS.
Recommendation
Update Progress Sitefinity to the latest patched version (14.4.8152, 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630).
Other vulnerabilities in Progress Sitefinity
See all- CVE-2026-7312Critical
Progress Sitefinity in multiple versions (14.0.7700-14.4.8152, 15.0.8200-15.0.8234, 15.1.8300-15.1.8335, 15.2.8400-15.2.8441, 15.3.8500-15.3.8531, 15.4.8600-15.4.8630) has a vulnerability due to insufficiently protected credentials. A remote unauthenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service.
- CVE-2026-7198Critical
Progress Sitefinity 15.4.8623 before version 15.4.8630 has an improper access control vulnerability. A remote unauthenticated attacker can access restricted content, leading to full compromise of confidentiality, integrity, and availability.
- CVE-2026-7313High
CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.
- CVE-2026-7201High
In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.
Original NVD description (English source)
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.