CVE-2026-7312

Estado: AnalizadaAlta (7.5)—

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.55%
Percentil entre todas las CVEs puntuadas: 44
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1552.007 Container APIcredential access90 %
Impacto secundarioT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access75 %

AV:N, PR:N, UI:N indica exposición web remota sin autenticación (T1190). Credenciales en texto plano (CWE-522) son acceso a credenciales almacenadas (T1552.007) y potencial abuso de cuenta (T1078.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Limit Access to Resource Over Network Vulnerability Scanning User Account Management Password Policies

Tecnologías afectadas (1)

Progress — Sitefinity

CWE

CWE-522

Referencias

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-7312",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7312",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T03:55:43.776367Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@progress.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@progress.com",
      "affectedData": [
        {
          "vendor": "Progress Software",
          "product": "Sitefinity",
          "versions": [
            {
              "status": "affected",
              "version": "14.0.7700",
              "lessThan": "14.4.8152",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.0.8200",
              "lessThan": "15.0.8234",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.1.8300",
              "lessThan": "15.1.8335",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.2.8400",
              "lessThan": "15.2.8441",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.3.8500",
              "lessThan": "15.3.8531",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.4.8600",
              "lessThan": "15.4.8630",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-02T14:17:14.470",
  "references": [
    {
      "url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@progress.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration."
    },
    {
      "lang": "es",
      "value": "CWE?522: Credenciales Insuficientemente Protegidas en servicios web en la versión de Progress Sitefinity desde la 14.0.7700 hasta la 14.4.8152, y de la 15.0.8200 hasta la 15.0.8234, y de la 15.1.8300 hasta la 15.1.8335, de la 15.2.8400 hasta la 15.2.8441, de la 15.3.8500 hasta la 15.3.8531, y de la 15.4.8600 hasta la 15.4.8630 permite a un atacante remoto no autenticado obtener credenciales en texto plano utilizadas para conectarse al servicio Sitefinity Insight. La explotación exitosa requiere integración activa con Sitefinity Insight y una configuración del sitio no predeterminada."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "745C0B62-500E-4888-8507-23CF85CC90B0",
              "versionEndExcluding": "14.4.8152",
              "versionStartIncluding": "14.0.7700"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60092E40-9CC0-4953-941B-716DA02A4544",
              "versionEndExcluding": "15.0.8234",
              "versionStartIncluding": "15.0.8200"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "301863BA-1B70-46DB-8239-46F54F3C9E9D",
              "versionEndExcluding": "15.1.8335",
              "versionStartIncluding": "15.1.8300"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55CA60C2-DDDC-44BA-A47D-934F3F946F37",
              "versionEndExcluding": "15.2.8441",
              "versionStartIncluding": "15.2.8400"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6C4CF7C-2C10-46F6-93C4-AC37A25CABE4",
              "versionEndExcluding": "15.3.8531",
              "versionStartIncluding": "15.3.8500"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0699CBF-3C82-416C-AC88-747609F482AC",
              "versionEndExcluding": "15.4.8630",
              "versionStartIncluding": "15.4.8600"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@progress.com"
}