This vulnerability (CVE-2026-7198) in Progress Software Sitefinity 15.4.8623 involves improper access control in its web services, permitting remote unauthenticated attackers to bypass restrictions and access protected content. This results in a complete compromise of confidentiality, integrity, and availability of the affected installations. The CVSS 3.1 base score is 9.8, reflecting its critical severity with network attack vector, no privileges required, and no user interaction needed. The vendor has not yet published an official fix or remediation guidance, and no known exploits have been reported.

Successful exploitation allows remote unauthenticated attackers to fully compromise the confidentiality, integrity, and availability of the affected Sitefinity installations. This means attackers can access sensitive content, modify data, or disrupt service without any authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Sitefinity web services where possible and monitor for unusual access patterns. Avoid exposing vulnerable versions to untrusted networks.