What is the CVSS score of EUVD-2026-33922?

EUVD-2026-33922 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Progress Sitefinity are affected by EUVD-2026-33922?

Progress Sitefinity CMS versions 8.0.5700 through 13.3.7652 contain a credential exposure vulnerability that permits authenticated administrative users to access plain-text credentials for the…. A patch is available.

How to fix or mitigate EUVD-2026-33922?

Within 24 hours: Identify Sitefinity deployments and determine which versions are in use (navigate to Settings > Version in Sitefinity back-end). Within 7 days: Restrict administrative back-end access to essential personnel only; enable detailed audit logging of credential configuration changes and analytics service access attempts. Within 30 days: Monitor Progress vendor advisories for patch availability for versions 8.0.5700 through 13.3.7652; plan migration to a patched version upon release.

Progress Sitefinity EUVD-2026-33922

| CVE-2026-7313 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-06-02 security@progress.com

GHSA-28j7-fpg4-34hj

Information Disclosure Sitefinity

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:32 vuln.today

DescriptionCVE.org

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

AnalysisAI

Credential exposure in Progress Sitefinity versions 8.0.5700 through 13.3.7652 allows authenticated back-end users to retrieve plain-text credentials used by the CMS to connect to the Sitefinity Insight analytics service. The CVSS 3.1 score of 8.7 with scope change (S:C) reflects that stolen Insight credentials can pivot into an adjacent system beyond the CMS itself. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; EPSS data was not provided in the input.

Technical ContextAI

Sitefinity is Progress Software's enterprise .NET-based CMS and digital experience platform. The flaw is classified as CWE-522 (Insufficiently Protected Credentials), meaning credentials are stored or transmitted in a recoverable form rather than being protected through hashing, encryption, or a secret-management layer. In this case, the integration credentials Sitefinity uses to authenticate to Sitefinity Insight (the analytics/personalization SaaS companion to the CMS) are exposed in plain text through web services accessible to authorized back-end users, rather than being masked or restricted to the configuration subsystem. The CVE description does not list a CWE in the structured NVD field (CWE: N/A) but the description text explicitly cites CWE-522.

RemediationAI

Apply the fix per the Progress Sitefinity May 2026 Security Advisory at https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026; the input does not name a specific fixed version, so the status is patch available per vendor advisory - confirm the exact upgrade target with Progress before deploying. After upgrading, rotate the Sitefinity Insight integration credentials since any prior values must be assumed disclosed to any back-end user who could reach the affected web services. Compensating controls until patched: restrict back-end Sitefinity administrative access to a small, audited set of accounts and enforce MFA on those accounts; temporarily disable the Sitefinity Insight integration if it is not business-critical (trade-off: loss of analytics and personalization data flow); and place the Sitefinity admin interface behind a VPN or IP allow-list to shrink the network exposure implied by AV:N. Review audit logs for unexpected access to the affected web service endpoints before rotation, because rotation alone will not reveal whether the secret has already been retrieved.