Multiple Critical Vulnerabilities in Progress Sitefinity Disclosed

Three critical vulnerabilities (CVE-2026-7195, CVE-2026-7312, CVE-2026-7201) have been identified in various versions of Progress Sitefinity, affecting user account integrity and confidentiality. CVE-2026-7195 allows unauthenticated attackers to exploit improper input validation, requiring user interaction and non-default configurations. CVE-2026-7312 exposes plain-text credentials to attackers via insufficiently protected credentials, also needing specific configurations. CVE-2026-7201 permits authenticated attackers to modify user account properties through an authorization bypass. All vulnerabilities were published on June 2, 2026, and patches are available for affected versions. Organizations are urged to upgrade to secure versions to mitigate risks associated with these vulnerabilities.

Key Points: • Three critical vulnerabilities in Progress Sitefinity were disclosed on June 2, 2026. • CVE-2026-7195 allows unauthenticated access to user account integrity through improper input validation. • Patches are available, and organizations are advised to upgrade to secure versions immediately.