Loading story…
Progress released security updates for Sitefinity CMS, Sitefinity Insight, and Kemp LoadMaster, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from 8.0 through 15.4. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, CVE-2026-7312 carries a CVSS 10.0 rating and can let an unauthenticated attacker obtain plaintext credentials used for Sitefinity Insight connections when that integration is enabled in a non-default configuration, while CVE-2026-7198 is rated CVSS 9.8 and allows unauthenticated access to restricted content in affected 15.4 deployments.
Additional Sitefinity flaws include CVE-2026-7201, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and CVE-2026-7313, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including 15.4.8630, 15.3.8531, 15.2.8441, 15.1.8335, 15.0.8234, 14.4.8152, and 13.3.7652, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting Progress Kemp LoadMaster.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-09, ZDI disclosed CVE-2026-8037, a critical unauthenticated remote code execution flaw in Progress Kemp LoadMaster's accessv2 endpoint involving the apiuser parameter. The advisory said Progress released an update to remediate the issue, and credited Syed Ibrahim Ahmed of TrendAI Research for the finding.
Between June 2 and June 4, 2026, Progress published security updates addressing critical vulnerabilities in Sitefinity CMS, Sitefinity Insight, and Progress Kemp LoadMaster. The updates covered multiple Sitefinity CVEs and two LoadMaster CVEs, with patched Sitefinity releases issued for supported branches.
On June 5, 2026, the Cyber Centre issued advisory AV26-552 highlighting Progress security updates published between June 2 and 4. The advisory urged administrators to review Progress bulletins and apply patches for affected Sitefinity and LoadMaster versions.
Several Sitefinity vulnerabilities, including CVE-2026-7201, CVE-2026-7312, and CVE-2026-7198, were received by security@progress.com on June 2, 2026. The reported issues included authorization bypass, improper access control, and exposure of plaintext credentials in Sitefinity web services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software released security updates for multiple products, including **Progress LoadMaster**, **Sitefinity CMS**, and **Sitefinity Insight**, warning that the vulnerabilities could expose sensitive information, let attackers modify other users' account properties, or enable arbitrary code execution. The most severe issues disclosed were **`CVE-2026-7312`**, an insufficiently protected credentials flaw in Sitefinity web services rated **CVSS 10.0**, and **`CVE-2026-8037`**, a **CVSS 9.6** command-injection vulnerability in Progress LoadMaster. Technical analysis published after the advisory showed that **`CVE-2026-8037`** is a **pre-authentication remote code execution** flaw in **Kemp LoadMaster** when its API is enabled, affecting **GA `v7.2.63.1` and earlier** and **LTSF `v7.2.54.17` and earlier**. Researchers said the bug stems from an uninitialized heap buffer and missing null terminator in the `escape_quotes()` function used by the `/accessv2` endpoint, allowing attacker-controlled input to be incorporated into a shell command executed via `system()`. Progress patched the issue in **`v7.2.63.2`** by replacing `malloc()` with `calloc()` and adding explicit string termination, and defenders were urged to apply updates as soon as testing is complete.
Jul 14, 2026
Progress Software disclosed and patched serious vulnerabilities in **Kemp LoadMaster** that could let attackers compromise load balancers deployed at the core of enterprise networks. The most prominent issue, tracked as **`CVE-2026-8037`**, was described in public advisories as affecting API methods including `dodelapikey` and `dolistapikeys`, where improper handling of memory could allow remote code execution after authentication, in some cases with **root** or administrator-level impact. Separate reporting also characterized `CVE-2026-8037` as a critical API command-injection issue that could permit arbitrary command execution and full administrative control of the appliance. Progress released updates to address the flaws, including patched firmware versions **`v7.2.63.2`** and **`v7.2.54.18`**, and said the fixes also apply to **ECS Connection Manager** and **Connection Manager for ObjectScale**. A second vulnerability, **`CVE-2026-33691`**, affects the **OWASP CRS** handling of multipart requests by failing to normalize whitespace in filenames, creating a path to bypass firewall extension checks. Security researchers credited in the disclosures include **Syed Ibrahim Ahmed** and **Jacky Yang** of TrendAI Research, and defenders were urged to patch quickly because compromise of internet-facing load balancers could provide a foothold for deeper intrusion into enterprise environments.
Jul 2, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026