CVE-2026-7195

Estado: AnalizadaAlta (8.1)—

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Puntuación base: 8.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.62%
Percentil entre todas las CVEs puntuadas: 48
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution85 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access75 %
Impacto secundarioT1556.001 Domain Controller Authenticationdefense impairment · persistence · credential access60 %

UI:R (interacción requerida) + web services + validación deficiente → T1203. El atacante compromete cuentas de usuario (T1078.001) e integridad/confidencialidad de datos (T1556.001 si hay manipulación de autenticación).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Multi-factor Authentication User Training Privileged Process Integrity Privileged Account Management Password Policies Application Isolation and Sandboxing

Tecnologías afectadas (1)

Progress — Sitefinity

CWE

CWE-20

Referencias

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-7195",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-7195",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@progress.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@progress.com",
      "affectedData": [
        {
          "vendor": "Progress Software",
          "product": "Sitefinity",
          "versions": [
            {
              "status": "affected",
              "version": "14.1.0",
              "lessThan": "14.4.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "14.4.8100",
              "lessThan": "14.4.8152",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.0.8200",
              "lessThan": "15.0.8234",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.1.8300",
              "lessThan": "15.1.8335",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.2.8400",
              "lessThan": "15.2.8441",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.3.8500",
              "lessThan": "15.3.8531",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.4.8600",
              "lessThan": "15.4.8630",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-06-02T14:17:14.073",
  "references": [
    {
      "url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@progress.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@progress.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration."
    },
    {
      "lang": "es",
      "value": "CWE-20: Validación de Entrada Inadecuada en servicios web en Progress Sitefinity 14.1.x hasta 14.3.x, 14.4.x anterior a 14.4.8152, 15.0.x anterior a 15.0.8234, 15.1.x anterior a 15.1.8335, 15.2.x anterior a 15.2.8441, 15.3.x anterior a 15.3.8531, y 15.4.x anterior a 15.4.8630 permite a un atacante remoto no autenticado comprometer la integridad y confidencialidad de las cuentas de usuario. La explotación exitosa requiere interacción del usuario y una configuración del sitio no predeterminada."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F331A1B-FC71-4594-952C-0A74211E5904",
              "versionEndExcluding": "14.4.8152",
              "versionStartIncluding": "14.1.7800"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60092E40-9CC0-4953-941B-716DA02A4544",
              "versionEndExcluding": "15.0.8234",
              "versionStartIncluding": "15.0.8200"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "301863BA-1B70-46DB-8239-46F54F3C9E9D",
              "versionEndExcluding": "15.1.8335",
              "versionStartIncluding": "15.1.8300"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55CA60C2-DDDC-44BA-A47D-934F3F946F37",
              "versionEndExcluding": "15.2.8441",
              "versionStartIncluding": "15.2.8400"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6C4CF7C-2C10-46F6-93C4-AC37A25CABE4",
              "versionEndExcluding": "15.3.8531",
              "versionStartIncluding": "15.3.8500"
            },
            {
              "criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0699CBF-3C82-416C-AC88-747609F482AC",
              "versionEndExcluding": "15.4.8630",
              "versionStartIncluding": "15.4.8600"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@progress.com"
}