Brief Summary: CVE-2026-7198 — Critical Unauthenticated Access Control Bypass in Progress Sitefinity OData Web Services

Introduction

A five-CVE advisory dropped today for Progress Sitefinity. The second most severe of the bunch, CVE-2026-7198, lets a completely unauthenticated remote attacker bypass access controls on OData web services endpoints and reach content that should be restricted. It carries a CVSS score of 9.8 with full impact on confidentiality, integrity, and availability, and it sits alongside a CVSS 10.0 sibling (CVE-2026-7312) in what amounts to a systemic breakdown of the Sitefinity web services authorization layer.

Progress Sitefinity is a .NET-based web content management system used by approximately 4,127 customers across 65 countries, with roughly 67% of deployments in the United States. The platform serves enterprise customers in education, insurance, and other verticals. Advance Auto Parts, NTT DATA, and Conduent are among its users. Sitefinity holds about 0.71% of the web content management market and competes with platforms like Drupal and TYPO3.

Technical Information

Root Cause: CWE-284 Improper Access Control in OData Web Services

CVE-2026-7198 is classified under CWE-284 (Improper Access Control), which means the OData Web Services component fails to properly enforce permissions on the resources it exposes. OData (Open Data Protocol) is a standardized REST-based protocol for building and consuming data APIs, and Sitefinity uses it to expose content data to front-end applications and integrations. Crafted HTTP requests can bypass the authorization checks that should restrict access to certain content served through these endpoints.

The vulnerability is recent. Only Sitefinity versions 15.4.8623 through 15.4.8629 are affected. Version 15.4.8623 was released on January 27, 2026, so this is a regression introduced in a patch release, and it has not been present across multiple major versions. Version 15.4.8630 contains the fix.

Attack Vector Analysis

Three characteristics of the attack make this vulnerability particularly concerning.

Network accessible, no authentication required. An attacker can exploit the flaw over HTTP/HTTPS against the OData web services endpoints with no valid credentials, no prior access to the Sitefinity instance, and no special privileges. That dramatically lowers the barrier to exploitation and makes internet-facing Sitefinity installations directly targetable.

Low attack complexity. The CVSS 9.8 score reported by Progress is consistent with the CVSS v3.1 vector pattern for unauthenticated, low-complexity, high-impact vulnerabilities. The advisory says exploitation works through "crafted requests" to the OData web services, which indicates that specially formed HTTP requests can bypass authorization checks.

Full CIA impact. The advisory states that successful exploitation results in "full compromise of confidentiality, integrity, and availability of affected installations." In practice:

• Confidentiality: Restricted content becomes reachable through the OData endpoint. It may include sensitive organizational data, user information, or administrative content not meant for the public.
• Integrity: Depending on which HTTP methods the vulnerable endpoint permits, an attacker may be able to modify content without authorization. OData supports GET, POST, PUT, PATCH, and DELETE operations.
• Availability: Unauthorized deletion or manipulation of content may disrupt service availability.

The Five-CVE Cluster: A Systemic Problem

The May 2026 Sitefinity advisory addresses five CVEs, and four of them target the same OData Web Services attack surface:

Four distinct vulnerability classes in a single component (improper access control, insufficiently protected credentials, improper input validation, and authorization bypass via user-controlled key) point to a systemic weakness in the OData web services authorization and input validation layer. The entire web services subsystem needs attention, and organizations should handle CVE-2026-7198 as one part of that problem.

An attacker who uses CVE-2026-7198 to bypass access controls could chain it with CVE-2026-7312 (insufficiently protected credentials, CVSS 10.0) or CVE-2026-7195 (improper input validation) for greater impact.

NVD Status

At the time of publication, the NVD entry for CVE-2026-7198 shows the status "Received" and "NVD assessment not yet provided," so NIST has not yet independently confirmed the CVSS score or vector string. The 9.8 score used throughout this post is the vendor's own assessment.

Affected Systems and Versions

The vulnerability affects a narrow version range within the Sitefinity 15.4.x branch:

• Vulnerable: Sitefinity CMS versions 15.4.8623 through 15.4.8629
• Fixed: Sitefinity CMS version 15.4.8630 and later

The companion CVEs in the same advisory affect broader version ranges. These patched versions address all five CVEs across the supported branches:

The latest version available at the time of the advisory is 15.4.8631. Progress strongly encourages customers on unsupported versions to update to the latest product version.

No workarounds are available. The advisory documents no temporary mitigation or configuration change that addresses the vulnerability without an upgrade. Organizations that cannot patch immediately should consider these compensating controls:

• Restrict network access to OData web services endpoints with WAF or reverse proxy rules.
• Monitor access logs for anomalous unauthenticated requests to OData endpoints.
• Segment the Sitefinity server from the broader network.

Progress has not endorsed these measures, and they have not been tested against this specific vulnerability.

Vendor Security History

Progress Software has a notable and troubled security track record, and it is important context for evaluating CVE-2026-7198.

The most significant incident in the company's history is the 2023 MOVEit Transfer zero-day breach. On May 31, 2023, Cl0p, a Russian-speaking cybercrime syndicate, exploited a SQL injection zero-day in MOVEit Transfer, Progress's managed file transfer product. The breach affected at least 2,500 firms and more than 66.4 million individuals, which makes it one of the largest supply-chain-style data breaches in history.

Beyond MOVEit, Progress has issued a steady stream of critical security advisories across its product lines in recent years:

• Sitefinity CVE-2025-1968 (April 2025): A High severity Sitefinity vulnerability with its own dedicated security advisory.
• MOVEit WAF Critical Security Bulletin (April 2026): Five CVEs (CVE-2026-3517, CVE-2026-3518, CVE-2026-3519, CVE-2026-4048, CVE-2026-21876) addressing authenticated command execution vulnerabilities.
• MOVEit Automation Critical Security Alert (April 2026): Two CVEs (CVE-2026-4670, CVE-2026-5174) addressing an authentication bypass vulnerability.
• Sitefinity and Telerik UI for ASP.NET AJAX (2017): A security alert addressing vulnerabilities in both products.

Critical vulnerabilities keep recurring across Progress products, particularly in web-facing services and authentication mechanisms, which suggests ongoing problems in the vendor's secure development lifecycle. The current five-CVE cluster in Sitefinity's web services layer fits the same pattern.

Threat Intelligence Context

As of June 2, 2026, there is no confirmed evidence of active exploitation of CVE-2026-7198 in the wild. The Progress advisory does not mention active exploitation, the CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) Catalog, and Proofpoint's May 2026 threat intelligence report on 2026 CVE exploitation does not reference CVE-2026-7198 or any of the companion Sitefinity CVEs.

However, the vulnerability was published only today, and several factors raise the likelihood of future exploitation.

2026 weaponization timelines are extremely compressed. Proofpoint telemetry shows 12 distinct 2026 CVEs already under active exploitation in network-facing attacks, some weaponized within 24 hours of disclosure. Russia-linked TA422 (APT28) weaponized CVE-2026-21509 (Microsoft Office RTF/OLE Code Execution) within a single day of public disclosure, and DPRK-aligned TA406 (Opal Sleet) chained CVE-2026-21510 with CVE-2026-21509 in active campaigns.

Progress Software is a known target. The MOVEit breach showed that sophisticated threat actors watch Progress products. Cl0p targeted MOVEit specifically for its enterprise capabilities. As a web-facing CMS, Sitefinity presents a similarly high-value attack surface.

The vulnerability profile is ideal for opportunistic exploitation. CVE-2026-7198 needs no authentication, is reachable over the network, has low complexity, and has high impact. Proofpoint notes that attackers "opportunistically use newly published CVEs when public proof of concept code becomes available." OData endpoints are commonly exposed to the internet, and security research has documented attack patterns against them.

No specific threat actors have been linked to CVE-2026-7198 yet. If exploitation techniques become available, the broader threat picture suggests the most likely attackers are Cl0p (given its history with Progress products), nation-state actors that move fast (TA422, TA406), and opportunistic ransomware operators.

Synthesis

The narrow affected version range (15.4.8623 through 15.4.8629) means a patch release introduced this critical security flaw. When an update intended to improve the product creates a new vulnerability, it raises questions about how robust Progress's quality assurance and security testing are for the OData web services layer. Four of the five CVEs in this advisory target OData Web Services, which adds to the concern that the component has not received adequate security review.

Organizations running affected versions should treat this as an emergency patching priority. The attack vector is unauthenticated, the web services attack surface is well understood, the vendor has already been targeted by sophisticated threat actors, and in 2026 weaponization can happen within hours. Together, these conditions strongly favor rapid exploitation once technical details circulate.

For organizations that cannot patch immediately, the most practical compensating controls are restricting network access to OData endpoints and aggressively monitoring unauthenticated requests to those endpoints. Neither is a substitute for the upgrade.

References

• NVD: CVE-2026-7198
• Progress Sitefinity Security Advisory: CVE-2026-7312, CVE-2026-7198, CVE-2026-7195, CVE-2026-7201, CVE-2026-7313 (May 2026)
• Proofpoint: CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild
• CISA Known Exploited Vulnerabilities Catalog
• ORX: MOVEit Transfer Data Breaches Deep Dive
• Progress Sitefinity Security Advisory: CVE-2025-1968 (April 2025)
• MOVEit WAF Critical Security Bulletin (April 2026)
• MOVEit Automation Critical Security Alert Bulletin (April 2026)
• 6sense: Progress Sitefinity Market Share and Competitor Insights
• OpenCVE: Sitefinity CVEs and Security Vulnerabilities
• Progress Sitefinity CMS 15.4.8623 Release Notes
• Canadian Centre for Cyber Security: Progress Security Advisory (AV26-410)
• Kaspersky Securelist: Exploits and Vulnerabilities in Q1 2026