CVE-2026-7198

CRITICAL

CWE-284: Improper Access Control in web services in Progress Sitefinity

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-7198 has a selected CVSS score of 9.8 (critical).

Description

CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 2, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Sitefinity

Browse Progress Software / Sitefinity

Default status: unaffected

CVE List15.4.8623 to < 15.4.8630affected

References

2