Loading story…
Researchers disclosed a pre-authenticated remote code execution chain affecting Progress ShareFile Storage Zone Controller 5.x. The chain combines CVE-2026-2699, an authentication bypass in /ConfigService/Admin.aspx caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious ASPX webshell to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments.
The issues were reported by watchTowr and fixed by Progress in ShareFile Storage Zone Controller 5.12.4. The research focused on the 5.x branch, including version 5.12.3, and highlighted substantial internet exposure: watchTowr said roughly 30,000 Storage Zone Controller instances were discoverable online, while Shadowserver observed about 700 internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting noted substantial exposure of ShareFile Storage Zone Controller systems on the internet, with watchTowr estimating roughly 30,000 discoverable instances and ShadowServer observing about 700 exposed Progress ShareFile systems. The exposed systems were reported as concentrated mainly in the United States and Europe.
watchTowr Labs publicly disclosed that CVE-2026-2699 and CVE-2026-2701 can be chained to achieve pre-authenticated remote code execution against internet-exposed on-premises ShareFile Storage Zone Controller 5.x systems. The disclosure described authentication bypass via /ConfigService/Admin.aspx and webshell placement through storage reconfiguration and ZIP extraction abuse.
Progress fixed two flaws in ShareFile Storage Zone Controller 5.x, tracked as CVE-2026-2699 and CVE-2026-2701, in version 5.12.4. The patched release was made available on 2026-03-10.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcerunzero.com
Open sourcebleepingcomputer.com
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026
Progress Software warned ShareFile customers using on-premises **Storage Zone Controllers** to immediately shut down the Windows servers hosting those systems after identifying a **credible external security threat**. The company also temporarily disabled access to ShareFile accounts that rely on those controllers as a precaution while it investigates with internal and external cybersecurity experts. Progress said it had **no indication of unauthorized access** to ShareFile accounts or data at the time of the notice. The alert affects hybrid ShareFile deployments where Internet-accessible Storage Zone Controllers broker file transfers between the ShareFile cloud service and customer-managed local storage. Progress did not disclose whether the threat is active exploitation, a zero-day, or a related issue tied to earlier ShareFile flaws, but the warning follows recently patched vulnerabilities **`CVE-2026-2699`** and **`CVE-2026-2701`**, which could be chained to bypass authentication, upload malicious **ASPX webshells**, and achieve remote code execution; those issues were fixed in **version 5.12.4**, while the **6.x .NET Core** branch was reported as unaffected.
Jul 10, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026