What is the CVSS score of CVE-2026-7312?

CVE-2026-7312 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Progress Sitefinity are affected by CVE-2026-7312?

Progress Sitefinity versions 14.0.7700-15.4.8630 contain a critical vulnerability (CVSS 10.0) enabling remote unauthenticated attackers to retrieve plaintext credentials for the Sitefinity Insight…. A patch is available.

How to fix or mitigate CVE-2026-7312?

24 hours: Identify all Progress Sitefinity instances in versions 14.0.7700-15.4.8630; determine which have Sitefinity Insight integration enabled; document current service account credentials. 7 days: Disable Sitefinity Insight integration where operationally permissible; implement network access controls restricting connections to analytics service endpoints; rotate all service credentials used by Insight connections. 30 days: Establish timeline with Progress for patch release and deployment plan to patched versions; prepare staging environment for testing; conduct post-patch credential audit and analytics log review for unauthorized access during exposure window.

Progress Sitefinity CVE-2026-7312

EUVD-2026-33921 CRITICAL

Insufficiently Protected Credentials (CWE-522)

2026-06-02 security@progress.com

GHSA-2h6v-g45h-32xx

Information Disclosure Sitefinity

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:30 vuln.today

DescriptionCVE.org

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

AnalysisAI

Credential disclosure in Progress Sitefinity 14.0.7700-15.4.8630 allows remote unauthenticated attackers to retrieve plaintext credentials used to connect to the Sitefinity Insight analytics service. The CVSS 10.0 score reflects network-reachable, no-auth, no-interaction exploitation with cross-scope impact, though exploitation is gated on the site having active Sitefinity Insight integration and a non-default configuration. No public exploit identified at time of analysis and the vendor (Progress) is the sole reporting source via a May 2026 advisory.

Technical ContextAI

Progress Sitefinity is a .NET-based digital experience and web content management platform commonly deployed for enterprise marketing sites. The vulnerability sits in Sitefinity's web services layer that handles configuration for the Sitefinity Insight integration - a separate Progress SaaS analytics/personalization product that ingests behavioral data from Sitefinity sites. The root cause maps to CWE-522 (Insufficiently Protected Credentials): the Insight connection credentials are exposed in plain text through a web service path reachable without authentication, rather than being protected behind admin-only endpoints or stored/transmitted only in protected form. The advisory does not specify the exact endpoint, but the CVSS Scope:Changed metric indicates the bug in Sitefinity yields impact against a separate security authority - consistent with stealing credentials that authenticate the site to the downstream Insight tenant.

RemediationAI

Patch available per vendor advisory - apply the fixed builds published by Progress in the May 2026 Sitefinity security advisory (https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026); exact post-fix version numbers per branch are not enumerated in the available data and must be confirmed against that advisory. As an interim compensating control while patching, customers running Sitefinity Insight integration should rotate the Insight API credentials immediately after patching (assume them compromised), disable the Insight integration if it is not in active use to eliminate the exposed credential, and place authentication or network-layer restrictions in front of Sitefinity's web service endpoints - for example by IP-allowlisting administrative paths at the reverse proxy or WAF - accepting that overly broad blocking can also break legitimate Insight callbacks and editor tooling. Reverting to the default site configuration, where compatible, also avoids the vulnerable code path per the vendor's description but may regress site behavior that depended on the customization.