Critical Progress Sitefinity flaws expose credentials and restricted content

Progress released security updates for Sitefinity CMS, Sitefinity Insight, and Kemp LoadMaster, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from 8.0 through 15.4. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, CVE-2026-7312 carries a CVSS 10.0 rating and can let an unauthenticated attacker obtain plaintext credentials used for Sitefinity Insight connections when that integration is enabled in a non-default configuration, while CVE-2026-7198 is rated CVSS 9.8 and allows unauthenticated access to restricted content in affected 15.4 deployments.

Additional Sitefinity flaws include CVE-2026-7201, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and CVE-2026-7313, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including 15.4.8630, 15.3.8531, 15.2.8441, 15.1.8335, 15.0.8234, 14.4.8152, and 13.3.7652, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting Progress Kemp LoadMaster.