What is the CVSS score of CVE-2026-7312?

CVE-2026-7312 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Progress Sitefinity are affected by CVE-2026-7312?

Progress Sitefinity versions 14.0.7700-14.4.8152 and 15.0.8200-15.4.8630 expose plaintext credentials for the Sitefinity Insight analytics service through unauthenticated web service access when…. A patch is available.

How to fix or mitigate CVE-2026-7312?

Within 24 hours, verify whether Sitefinity Insight integration is enabled in all production instances and document which teams manage affected systems. Within 7 days, apply the vendor-released patch to all affected Sitefinity instances across the 14.0 and 15.0 branches, prioritizing systems with Insight integration active. Within 30 days, rotate all Sitefinity Insight service account credentials across your environment and audit access logs for unauthorized activity since the vulnerability window opened.

Progress Sitefinity CVE-2026-7312

EUVD-2026-33921 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-06-02 security@progress.com

GHSA-2h6v-g45h-32xx

Information Disclosure Sitefinity Progress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but the required Insight integration plus non-default configuration raises complexity to AC:H; only credential confidentiality is impacted (C:H, I:N/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 19:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 19:22 NVD

CRITICAL HIGH

CVSS changed

Jul 22, 2026 - 19:22 NVD

10.0 (CRITICAL) 7.5 (HIGH)

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:30 vuln.today

DescriptionNVD

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

AnalysisAI

Credential disclosure in Progress Sitefinity (14.0.7700-14.4.8152 and the 15.0.8200 through 15.4.8630 branches) lets a remote unauthenticated attacker retrieve plain-text credentials used to connect to the Sitefinity Insight analytics service via exposed web services. The flaw (CWE-522) only surfaces when Sitefinity Insight integration is active and the site runs a non-default configuration. No public exploit identified at time of analysis and EPSS is low (0.03%), but SSVC rates the technical impact as total and the issue as automatable.

Technical ContextAI

Sitefinity is Progress Software's .NET-based digital experience platform (CMS/DXP). The vulnerability is a CWE-522 Insufficiently Protected Credentials weakness: credentials that authenticate Sitefinity to its cloud-based Sitefinity Insight customer-data/analytics service are stored or exposed such that web services return them in plain text rather than protecting them (e.g., via encryption or access control). The affected component is the web-services layer of the Sitefinity application (CPE cpe:2.3:a:progress:sitefinity across the listed version ranges). Because the exposed secret is a service-to-service integration credential, its disclosure enables lateral access to the connected Insight tenant rather than direct compromise of the Sitefinity host itself.

RemediationAI

Patch available per vendor advisory: upgrade to the fixed build for your branch - 14.4.8152 or later for the 14.x line, and 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630 (or later) for the corresponding 15.x branches, as published in the Progress Sitefinity Security Advisory (May 2026): https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026. If immediate patching is not possible, reduce exposure by disabling the Sitefinity Insight integration where it is not required (removes the exposed credential path but stops Insight analytics collection), and restrict network access to the Sitefinity web-services endpoints to trusted origins via WAF or firewall rules (may break legitimate integrations if scoped too broadly). After patching, rotate the Sitefinity Insight connection credentials, since any pre-patch exposure should be treated as a potential compromise. See also NVD detail https://nvd.nist.gov/vuln/detail/CVE-2026-7312 and VulDB entry https://vuldb.com/vuln/367940.