CVE-2026-7313
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.
Risk Assessment
Exposure of plain-text credentials may allow an attacker to access sensitive data or perform further attacks on the system.
Recommendation
Update Progress Sitefinity to a version later than 13.3.7652 or apply available patches.
Other vulnerabilities in Progress Sitefinity
See all- CVE-2026-7312Critical
Progress Sitefinity in multiple versions (14.0.7700-14.4.8152, 15.0.8200-15.0.8234, 15.1.8300-15.1.8335, 15.2.8400-15.2.8441, 15.3.8500-15.3.8531, 15.4.8600-15.4.8630) has a vulnerability due to insufficiently protected credentials. A remote unauthenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service.
- CVE-2026-7198Critical
Progress Sitefinity 15.4.8623 before version 15.4.8630 has an improper access control vulnerability. A remote unauthenticated attacker can access restricted content, leading to full compromise of confidentiality, integrity, and availability.
- CVE-2026-7201High
In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.
- CVE-2026-7195High
Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.
Original NVD description (English source)
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.