EUVD-2026-33921
GHSA-2h6v-g45h-32xx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Sitefinity site with Insight enabled
-
DeliverySend unauthenticated request to web service
-
ExploitReceive plain-text Insight credentials
-
ExecutionAuthenticate to Insight tenant
-
ImpactAccess customer analytics data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Exploitation requires that the target Sitefinity site has active integration with the Sitefinity Insight service configured, AND that the site runs a non-default configuration - both are stated explicitly in the CVE description as prerequisites for successful exploitation. When those conditions are met, no authentication or user interaction is needed (AV:N/AC:L/PR:N/UI:N): a remote attacker can retrieve the plain-text Insight credentials directly. The limiting factors are precisely those two prerequisites - deployments without Sitefinity Insight integration, or those left on default configuration, are not exploitable, which substantially narrows the affected population despite the network-facing unauthenticated vector. |
| Impact | Signals conflict and must be weighed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) describes trivial network, unauthenticated, confidentiality-only exposure, and SSVC marks it Automatable=yes with Technical Impact=total - arguments for prioritization. However, EPSS is very low (0.03%, 10th percentile), SSVC exploitation status is 'none', and it is not on CISA KEV, indicating little real-world activity so far. Critically, the description imposes two preconditions absent from the CVSS vector: the target must have active Sitefinity Insight integration AND a non-default site configuration. This meaningfully narrows the exploitable population and means the effective attack complexity is higher than AC:L implies. Net: a real but conditional confidentiality issue best treated as prompt-patch for environments that actually use Insight, and low priority for the majority of deployments that do not. |
| Exploit ScenarioDerived | An attacker who identifies a Sitefinity site with Insight integration enabled sends an unauthenticated HTTP request to the exposed web-services endpoint and receives the plain-text Insight connection credentials in the response. The attacker then uses those credentials to authenticate to the victim's Sitefinity Insight tenant and access customer analytics/behavioral data. Given AV:N/AC:L/PR:N the request itself is trivial; no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 22, 2026
Credential disclosure in Progress Sitefinity (14.0.7700-14.4.8152 and the 15.0.8200 through 15.4.8630 branches) lets a remote unauthenticated attacker retrieve plain-text credentials used to connect to the Sitefinity Insight analytics service via exposed web services. The flaw (CWE-522) only surfaces when Sitefinity Insight integration is active and the site runs a non-default configuration. No public exploit identified at time of analysis and EPSS is low (0.03%), but SSVC rates the technical impact as total and the issue as automatable.
Earlier versions of this analysis (1)
Credential disclosure in Progress Sitefinity 14.0.7700-15.4.8630 allows remote unauthenticated attackers to retrieve plaintext credentials used to connect to the Sitefinity Insight analytics service. The CVSS 10.0 score reflects network-reachable, no-auth, no-interaction exploitation with cross-scope impact, though exploitation is gated on the site having active Sitefinity Insight integration and a non-default configuration. No public exploit identified at time of analysis and the vendor (Progress) is the sole reporting source via a May 2026 advisory.
RemediationAI
Patch available per vendor advisory: upgrade to the fixed build for your branch - 14.4.8152 or later for the 14.x line, and 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630 (or later) for the corresponding 15.x branches, as published in the Progress Sitefinity Security Advisory (May 2026): https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026. If immediate patching is not possible, reduce exposure by disabling the Sitefinity Insight integration where it is not required (removes the exposed credential path but stops Insight analytics collection), and restrict network access to the Sitefinity web-services endpoints to trusted origins via WAF or firewall rules (may break legitimate integrations if scoped too broadly). After patching, rotate the Sitefinity Insight connection credentials, since any pre-patch exposure should be treated as a potential compromise. See also NVD detail https://nvd.nist.gov/vuln/detail/CVE-2026-7312 and VulDB entry https://vuldb.com/vuln/367940.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sitefinity is Progress Software's .NET-based digital experience platform (CMS/DXP). The vulnerability is a CWE-522 Insufficiently Protected Credentials weakness: credentials that authenticate Sitefinity to its cloud-based Sitefinity Insight customer-data/analytics service are stored or exposed such that web services return them in plain text rather than protecting them (e.g., via encryption or access control). The affected component is the web-services layer of the Sitefinity application (CPE cpe:2.3:a:progress:sitefinity across the listed version ranges). Because the exposed secret is a service-to-service integration credential, its disclosure enables lateral access to the connected Insight tenant rather than direct compromise of the Sitefinity host itself.
Know when Progress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable and unauthenticated (AV:N/PR:N), but the required Insight integration plus non-default configuration raises complexity to AC:H; only credential confidentiality is impacted (C:H, I:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.
Executive ViewAI
Progress Sitefinity versions 14.0.7700-14.4.8152 and 15.0.8200-15.4.8630 expose plaintext credentials for the Sitefinity Insight analytics service through unauthenticated web service access when analytics integration is enabled. Any external attacker can retrieve service account credentials, enabling unauthorized access to analytics infrastructure and potential lateral movement into connected systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary s
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization v
SQL injection vulnerability in WrVMwareHostList.asp in Ipswitch WhatsUp Gold 15.02 allows remote attackers to execute ar
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized
Unauthenticated remote code execution affects Progress ShareFile Storage Zones Controller versions up to 5.12.3 via unau
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injec
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to r
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress Wh
Exploit-DB