What is the CVSS score of CVE-2026-7198?

CVE-2026-7198 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Progress Sitefinity are affected by CVE-2026-7198?

Critical vulnerability in Progress Sitefinity exposes all organizational data and system operations to unauthorized remote access without authentication.. A patch is available.

How to fix or mitigate CVE-2026-7198?

Within 24 hours: identify all Progress Sitefinity instances and document versions in use. Within 7 days: restrict network access to Sitefinity web services to authorized IP ranges, deploy WAF rules to block unauthorized content access, and contact Progress support for patch release timeline and version 15.4.8630 availability. Within 30 days: deploy version 15.4.8630 or later as the vendor releases the patch.

Progress Sitefinity CVE-2026-7198

EUVD-2026-33919 CRITICAL

Improper Access Control (CWE-284)

2026-06-02 security@progress.com

GHSA-9pjg-65cc-3h57

Authentication Bypass Sitefinity

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:31 vuln.today

DescriptionCVE.org

CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.

AnalysisAI

Unauthenticated access control bypass in Progress Sitefinity 15.4.8623 (fixed in 15.4.8630) enables remote attackers to reach restricted content via the product's web services, leading to full compromise of confidentiality, integrity, and availability. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) rating reflects trivial network-reachable exploitation, and Progress has issued a coordinated advisory covering this and four sibling CVEs; no public exploit identified at time of analysis.

Technical ContextAI

Progress Sitefinity is a .NET-based digital experience / content management platform that exposes administrative and content APIs through web service endpoints. The flaw is classified as CWE-284 (Improper Access Control), meaning an authorization decision in one or more of these web service handlers fails to enforce the expected restriction - typically because an endpoint either omits an authorization attribute, trusts a client-controlled identifier, or evaluates permissions against the wrong principal. Because Sitefinity's web services are the same surface used for content management and configuration, a broken access check there directly maps to read/write access on otherwise protected resources rather than only data disclosure.

RemediationAI

Vendor-released patch: Progress Sitefinity 15.4.8630 - upgrade 15.4.8623 installations to that build using the May 2026 Sitefinity Security Advisory at https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026, which also addresses CVE-2026-7312, CVE-2026-7195, CVE-2026-7201, and CVE-2026-7313 in the same release. If patching cannot occur immediately, restrict network reachability of the Sitefinity web services to trusted management networks via firewall or WAF rules and block external access to the /Sitefinity/Services/ and related service endpoints - note this will break any legitimate external integrations or headless front-ends that consume those APIs, so inventory consumers first. Increase monitoring on the web service paths for anomalous unauthenticated requests and unexpected content reads or writes until the upgrade is applied.