Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-7195

CWE-20: Improper Input Validation in web services in Progress Sitefinity

High8.8EPSS 0.43%
Published
Updated
Reserved
Assigned by
ProgressSoftware

Description

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.

Timeline

  1. ID reserved

    By ProgressSoftware

  2. · 36 days later

    Published

  3. · 2 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-7195, by who scored it
Scored byCVSSScoreVector
ProgressSoftwareCNA (assigner)3.1High8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1High8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS (exploitation in 30 days)
0.43% · top 62% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Affected products

  • Progress Software · Sitefinity

    • affected 14.1.0 – < 14.4.0
    • affected 14.4.8100 – < 14.4.8152
    • affected 15.0.8200 – < 15.0.8234
    • affected 15.1.8300 – < 15.1.8335
    • affected 15.2.8400 – < 15.2.8441
    • affected 15.3.8500 – < 15.3.8531
    • affected 15.4.8600 – < 15.4.8630

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-7195 badge
[![CVE-2026-7195](https://trackcve.app/badge/CVE-2026-7195.svg)](https://trackcve.app/cve/CVE-2026-7195)

Record last updated .