What is the CVSS score of CVE-2026-7195?

CVE-2026-7195 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Progress Sitefinity are affected by CVE-2026-7195?

Progress Sitefinity CMS versions 14.1.x through 15.4.x contain a high-severity vulnerability enabling account compromise when administrators use non-default site configurations and users interact…. A patch is available.

How to fix or mitigate CVE-2026-7195?

Within 24 hours: Identify all Sitefinity CMS instances running versions 14.1.x-15.4.x and determine which are configured with non-default settings. Within 7 days: For high-risk systems, implement mitigations including reverting to default configurations where feasible, restricting administrative change privileges, and deploying WAF rules to validate web service input. Within 30 days: Apply the Progress Sitefinity May 2026 fix train release when available or migrate to confirmed unaffected versions per vendor advisory.

Progress Sitefinity CVE-2026-7195

EUVD-2026-33918 HIGH

Improper Input Validation (CWE-20)

2026-06-02 security@progress.com

GHSA-5846-8mmv-m39j

Information Disclosure Sitefinity

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:31 vuln.today

DescriptionCVE.org

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

AnalysisAI

Account compromise in Progress Sitefinity CMS (14.1.x-15.4.x prior to the May 2026 fix train) allows a remote unauthenticated attacker to violate the integrity and confidentiality of user accounts when an administrator runs a non-default site configuration and a victim is induced to interact with attacker-controlled content. The flaw is rooted in improper input validation (CWE-20) in Sitefinity's web services and carries a high CVSS of 8.8, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Progress Sitefinity is a .NET-based digital experience and content management platform widely deployed for public-facing corporate websites and customer portals. The weakness sits in the product's web service tier and is classified under CWE-20 (Improper Input Validation), meaning a component accepts data from clients without sufficiently constraining its type, format, or semantic content before acting on it. Because the affected surface is the web services layer, the validation gap is reachable over HTTP(S) without prior authentication, but the actual user-account compromise requires the victim's browser session or click to complete the chain - consistent with patterns such as request forgery, reflected injection, or unsafe deserialization of user-supplied parameters triggered through a crafted link.

RemediationAI

The primary remediation is to install the vendor-released patched builds: upgrade to Sitefinity 14.4.8152, 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630 (or later) on the matching branch, as published in the Progress Sitefinity Security Advisory of May 2026 at https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026; the 14.1.x-14.3.x branches appear unpatched, so migration to a supported branch is required for those deployments. If immediate patching is not feasible, audit which non-default site configuration enables the issue (consult the advisory for the exact toggle) and revert it to default - this is the most targeted compensating control and will reduce functionality only for the feature being disabled. As secondary mitigations, place the Sitefinity web-service endpoints behind a WAF rule that constrains the parameters identified by Progress, and reduce phishing surface by enforcing SameSite cookies and CSP on authenticated admin sessions, accepting that this hardens but does not eliminate the user-interaction step.