Vulnerabilities ›

CVE-2026-7312

Critical

CWE-522 — Weakness Type

                    Published: Jun 2, 2026                      ·  Modified: Jun 9, 2026                      ·  Source: NVD                

CVSS v3

10.0

🔗 NVD Official

📄 Description (English)

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

🤖 AI Executive Summary

Progress Sitefinity versions 14.0-15.4 contain insufficiently protected credentials in web services that allow remote unauthenticated attackers to obtain plaintext credentials for Sitefinity Insight service. Exploitation requires active Sitefinity Insight integration and non-default site configuration.

📄 Description (Arabic)

يسمح هذا الثغر للمهاجمين غير المصرح لهم بالوصول إلى بيانات اعتماد النص العادي المستخدمة للاتصال بخدمة Sitefinity Insight من خلال نقاط نهاية خدمات الويب غير المحمية بشكل كافٍ. يتطلب الاستغلال الناجح تكاملاً نشطاً مع Sitefinity Insight وتكوين موقع غير افتراضي. تؤثر هذه الثغرة على عدة إصدارات من الإصدار 14 والإصدار 15 من Progress Sitefinity.

🤖 ملخص تنفيذي (AI)

🤖 AI Intelligence Analysis Analyzed: Jun 6, 2026 18:08

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking telecom government healthcare

🎯 MITRE ATT&CK Techniques

T1110 T1187 T1589 T1598

⚖️ Saudi Risk Score (AI)

10.0

/ 10.0

🔧 Remediation Steps (English)

Update Progress Sitefinity to patched versions beyond 14.4.8152, 15.0.8234, 15.1.8335, 15.2.8441, 15.3.8531, or 15.4.8630. Disable Sitefinity Insight integration if not required. Implement network segmentation and access controls to restrict exposure of web service endpoints. Review and enforce default secure configurations.

🔧 خطوات المعالجة (العربية)

قم بتحديث Progress Sitefinity إلى الإصدارات المصححة التي تتجاوز 14.4.8152 و15.0.8234 و15.1.8335 و15.2.8441 و15.3.8531 أو 15.4.8630. عطّل تكامل Sitefinity Insight إذا لم يكن مطلوباً. طبّق تقسيم الشبكة والتحكم في الوصول لتقييد تعرض نقاط نهاية خدمات الويب. راجع وفرض التكوينات الآمنة الافتراضية.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

AC-2 AC-3 SC-7

🔵 SAMA CSF

CC-6.1 CC-6.2

🟡 ISO 27001:2022

A.9.2.1 A.9.4.3 A.10.1.1

🔗 References & Sources 1

🔗

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Se...

security@progress.com

Vendor Advisory

📦 Affected Products / CPE 6 entries

progress:sitefinity

📊 CVSS Score

10.0

/ 10.0 — Critical

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeC — Changed

ConfidentialityH — High

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity Critical

CVSS Score10.0

CWECWE-522

EPSS0.03%

Exploit No

Patch ✗ No

Published 2026-06-02

Source Feed nvd

🇸🇦 Saudi Risk Score

10.0

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

CWE-522

🏢 Vendor Advisories

🔗 https://community.progress.com/s/article/Sitefinity-...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-7312

Introduce Yourself

Sign In Required