What is the CVSS score of CVE-2026-7195?

CVE-2026-7195 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Progress Sitefinity are affected by CVE-2026-7195?

Progress Sitefinity versions 14.1.x through 15.4.x contain a vulnerability enabling account compromise when sites run non-default configurations.. A patch is available.

How to fix or mitigate CVE-2026-7195?

Within 24 hours, inventory all Progress Sitefinity deployments to identify instances running versions 14.1.x through 15.4.x and assess which sites use non-default configurations increasing exposure. Within 7 days, apply Progress's May 2026 security fixes or upgrade affected instances to patched versions (15.5.x or later) and validate updates in staging environments. Within 30 days, complete production deployment of patches across all Sitefinity instances and enable account authentication anomaly alerting to detect exploitation attempts.

Progress Sitefinity CVE-2026-7195

EUVD-2026-33918 HIGH

Improper Input Validation (CWE-20)

2026-06-02 security@progress.com

GHSA-5846-8mmv-m39j

Information Disclosure Sitefinity Progress

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network, unauthenticated, but the required non-default configuration plus victim interaction raise complexity (AC:H, UI:R); high C/I on user accounts, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 19:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 19:22 NVD

8.8 (HIGH) 8.1 (HIGH)

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:31 vuln.today

DescriptionNVD

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

AnalysisAI

Account compromise in Progress Sitefinity (14.1.x-15.4.x, prior to the May 2026 fixes) lets a remote unauthenticated attacker undermine the confidentiality and integrity of user accounts by exploiting improper input validation in the platform's web services. Exploitation hinges on tricking a victim into interacting with attacker-supplied content and only works when the site runs a non-default configuration. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV, though the vendor rates the technical impact as total.

Technical ContextAI

Sitefinity is Progress Software's commercial .NET-based CMS/digital experience platform used to build and manage websites and web applications. The root cause is CWE-20 (Improper Input Validation) in one or more of Sitefinity's exposed web service endpoints: the application accepts and processes attacker-influenced input without adequately validating it, allowing the attacker to manipulate operations tied to user accounts. All affected builds map to the single CPE product cpe:2.3:a:progress:sitefinity (version-ranged in the advisory), confirming the issue is in the Sitefinity application layer rather than an underlying OS or third-party library. Because the impact is described against 'user accounts,' the validation gap most plausibly sits in an account- or identity-related web service that mishandles crafted requests.

RemediationAI

Vendor-released patch: upgrade to the fixed build for your branch - 14.4.8152, 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630 (or later); the 14.1.x-14.3.x line should be moved onto a patched 14.4.x+ build, per the Progress May 2026 advisory at https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026. Because exploitation requires a non-default site configuration, an effective interim compensating control is to identify and revert or disable that specific non-default setting on the affected web service (consult the advisory for the exact configuration named), which removes the exploitation precondition at the cost of losing whatever functionality that setting enabled. Additionally, since the attack requires victim interaction, restricting/authenticating access to the affected web service endpoints and putting the site behind a WAF to filter malformed requests to those endpoints reduces exposure, with the trade-off of potential false positives against legitimate traffic; validate all changes in staging before production rollout.