PT-2026-45759 · Progress · Sitefinity

Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-7195

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Sitefinity versions 14.1 through 14.3 Progress Sitefinity versions prior to 14.4.8152 Progress Sitefinity versions prior to 15.0.8234 Progress Sitefinity versions prior to 15.1.8335 Progress Sitefinity versions prior to 15.2.8441 Progress Sitefinity versions prior to 15.3.8531 Progress Sitefinity versions prior to 15.4.8630

Description Improper input validation in web services allows a remote unauthenticated attacker to achieve remote code execution and compromise the integrity and confidentiality of user accounts. Successful exploitation requires a non-default site configuration and user interaction.

Recommendations Update versions 14.1 through 14.3 to a patched release. Update versions prior to 14.4.8152 to version 14.4.8152 or later. Update versions prior to 15.0.8234 to version 15.0.8234 or later. Update versions prior to 15.1.8335 to version 15.1.8335 or later. Update versions prior to 15.2.8441 to version 15.2.8441 or later. Update versions prior to 15.3.8531 to version 15.3.8531 or later. Update versions prior to 15.4.8630 to version 15.4.8630 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-7195

Affected Products

Sitefinity

References · 3

• https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7195 · Security Note
• https://twitter.com/VulmonFeeds/status/2061849236140941442 · Twitter Post