Login Request a demo
Critical severity · published Jun 2, 2026
CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress Sitefinity
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sitefinity · Progress Software
15.4.8623 before 15.4.8630 · source: vendor, NVD
Affected product
SI
Sitefinity
Progress Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7198
Vendor Advisory
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026
More from Sitefinity
8.8
CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
8.1
CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progress Sitefinity
7.5
CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
4.9
CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity