Medium severity · published Jun 2, 2026
CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
4.9
CVSS
0.3%
EPSS
No
On KEV
Description
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sitefinity · Progress Software
8.0.5700 before 13.3.7652 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7313
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7313
Vendor Advisory
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026
More from Sitefinity
9.8
CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress Sitefinity
8.8
CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
8.1
CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progress Sitefinity
7.5
CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity