CVE-2026-7313: CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-02 · updated 2026-07-22
Weakness: CWE-522

Description

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

Affected products

Progress Software Corporation Sitefinity: from 8.0.5700 before 13.3.7652 — fixed in 13.3.7652

How to fix

Upgrade to a fixed version: Progress Software Corporation Sitefinity 13.3.7652. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

Get alerted when CVE-2026-7313 or the next vulnerability affects your stack