CVE-2026-7312
A security flaw in Progress Sitefinity allows attackers to access plain-text credentials used to connect to the Sitefinity Insight service. This vulnerability occurs because credentials are not sufficiently protected within the web service.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Progress Sitefinity versions 14.0.7700 to 14.4.8152, 15.0.8200 to 15.0.8234, 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630, specifically those using active Sitefinity Insight integration and non-default configurations.
Real-world impact
An attacker could remotely steal sensitive login credentials without needing an account on the system, potentially gaining unauthorized access to the Sitefinity Insight service.
Why this severity
This vulnerability is rated critical because it allows a remote attacker to steal sensitive credentials over the network without any user interaction or authentication.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 2, 2026 · Jun 2, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- community.progress.com/s/article/Sitefinity-Securi…vendor advisory