9.8 CriticalCWE-284
CVE-2026-7198
Progress Software Sitefinity vulnerability
Progress SoftwareSitefinity
Status
- Not in CISA KEV
- Fixed in version 15.4.8630
Exploit probabilityEPSSchecked 25 Oct
0.7%probability of exploitation in the next 30 days
Higher than 50% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
Coverage 1 article · 1 outlet
- Critical Sitefinity Vulnerabilities: CVSS 10.0 Security AlertSecurityOnline · first in our coverage · mentions it in passing