Loading story…
Progress disclosed two high-severity vulnerabilities in Customer Managed ShareFile Storage Zones Controller (SZC) that could expose organizations to unauthorized access and remote code execution. CVE-2026-2699 allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-284 and CWE-698.
A second issue, CVE-2026-2701, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a CVSS 8.8 rating (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is mapped to CWE-94, CWE-78, and CWE-434. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-02, Progress disclosed fixes for CVE-2026-2699 and CVE-2026-2701 in ShareFile Storage Zones Controller v5.12.4 and advised customers to upgrade or move to any unaffected v6 release. The company also said it had not received reports of active exploitation at the time of the notice.
On 2026-04-02, public CVE entries were published for both vulnerabilities with high-severity CVSS v3.1 scores, CWE mappings, and vendor/security advisory references. The CVE-2026-2699 record was also updated the same day to add a WatchTowr Labs reference.
On 2026-04-02, Progress received vulnerability reports affecting Customer Managed ShareFile Storage Zones Controller. CVE-2026-2699 allows unauthenticated access to restricted configuration pages with possible configuration changes and remote code execution, while CVE-2026-2701 allows an authenticated user to upload and execute a malicious file on the server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcedocs.sharefile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a **pre-authenticated remote code execution** chain affecting **Progress ShareFile Storage Zone Controller 5.x**. The chain combines **CVE-2026-2699**, an authentication bypass in `/ConfigService/Admin.aspx` caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious **ASPX webshell** to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments. The issues were reported by watchTowr and fixed by Progress in **ShareFile Storage Zone Controller 5.12.4**. The research focused on the **5.x** branch, including version **5.12.3**, and highlighted substantial internet exposure: watchTowr said roughly **30,000** Storage Zone Controller instances were discoverable online, while Shadowserver observed about **700** internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Jun 29, 2026
Progress Software warned ShareFile customers using on-premises **Storage Zone Controllers** to immediately shut down the Windows servers hosting those systems after identifying a **credible external security threat**. The company also temporarily disabled access to ShareFile accounts that rely on those controllers as a precaution while it investigates with internal and external cybersecurity experts. Progress said it had **no indication of unauthorized access** to ShareFile accounts or data at the time of the notice. The alert affects hybrid ShareFile deployments where Internet-accessible Storage Zone Controllers broker file transfers between the ShareFile cloud service and customer-managed local storage. Progress did not disclose whether the threat is active exploitation, a zero-day, or a related issue tied to earlier ShareFile flaws, but the warning follows recently patched vulnerabilities **`CVE-2026-2699`** and **`CVE-2026-2701`**, which could be chained to bypass authentication, upload malicious **ASPX webshells**, and achieve remote code execution; those issues were fixed in **version 5.12.4**, while the **6.x .NET Core** branch was reported as unaffected.
Jul 10, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026