CVE-2026-7312

Web services in Progress Sitefinity store or transmit credentials in an insufficiently protected manner (Insufficiently Protected Credentials). An attacker without any authentication, operating remotely over the network, is able to read these data in plain-text form. Successful exploitation requires active integration with Sitefinity Insight service and non-default site configuration.

An attacker can obtain plain-text credentials used for communication with Sitefinity Insight, which may enable unauthorized access to associated services and data processed by this integration.

Apply patches available from the vendor according to references published in the Progress Sitefinity security advisory (May 2026). Urgent update to versions not listed in the vulnerable ranges is recommended, along with verification of Sitefinity Insight integration configuration.

Progress Sitefinity in versions: 14.0.7700–14.4.8152, 15.0.8200–15.0.8234, 15.1.8300–15.1.8335, 15.2.8400–15.2.8441, 15.3.8500–15.3.8531 and 15.4.8600–15.4.8630