Loading story…
Progress Software warned ShareFile customers using on-premises Storage Zone Controllers to immediately shut down the Windows servers hosting those systems after identifying a credible external security threat. The company also temporarily disabled access to ShareFile accounts that rely on those controllers as a precaution while it investigates with internal and external cybersecurity experts. Progress said it had no indication of unauthorized access to ShareFile accounts or data at the time of the notice.
The alert affects hybrid ShareFile deployments where Internet-accessible Storage Zone Controllers broker file transfers between the ShareFile cloud service and customer-managed local storage. Progress did not disclose whether the threat is active exploitation, a zero-day, or a related issue tied to earlier ShareFile flaws, but the warning follows recently patched vulnerabilities CVE-2026-2699 and CVE-2026-2701, which could be chained to bypass authentication, upload malicious ASPX webshells, and achieve remote code execution; those issues were fixed in version 5.12.4, while the 6.x .NET Core branch was reported as unaffected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported that ShareFile Storage Zone Controller had previously been affected by chainable vulnerabilities CVE-2026-2699 and CVE-2026-2701, which allowed authentication bypass, malicious ASPX webshell upload, and remote code execution. Those flaws were patched in version 5.12.4, and the 6.x .NET Core branch was reported as unaffected.
In its notice, Progress stated it had no indication or current evidence of unauthorized access to ShareFile accounts or data at the time of the warning. The company said it was investigating the threat with internal and external cybersecurity experts.
Progress Software issued an urgent advisory telling ShareFile customers using on-premises Storage Zone Controllers to immediately shut down the Windows servers hosting those controllers because of a credible external security threat. As a precaution, the company also temporarily disabled access to ShareFile accounts that use Storage Zone Controllers while it investigated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcelabs.beazley.security
Open sourcestatus.sharefile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a **pre-authenticated remote code execution** chain affecting **Progress ShareFile Storage Zone Controller 5.x**. The chain combines **CVE-2026-2699**, an authentication bypass in `/ConfigService/Admin.aspx` caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious **ASPX webshell** to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments. The issues were reported by watchTowr and fixed by Progress in **ShareFile Storage Zone Controller 5.12.4**. The research focused on the **5.x** branch, including version **5.12.3**, and highlighted substantial internet exposure: watchTowr said roughly **30,000** Storage Zone Controller instances were discoverable online, while Shadowserver observed about **700** internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Jun 29, 2026
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026
Progress Software disclosed two critical vulnerabilities in **MOVEit Automation**, including **CVE-2026-4670**, an improper authentication flaw that can allow authentication bypass over the network without user interaction. The issue is rated critical with CVSS `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating potential for high-impact compromise of confidentiality, integrity, and availability. Progress linked the flaw to **CWE-305** and included it in a security bulletin covering both **CVE-2026-4670** and **CVE-2026-5174**. The advisories affect multiple MOVEit Automation release branches, including versions prior to **2025.0.9**, **2024.1.8**, and releases before **2024.0.0**, with broader vendor and government guidance also referencing affected builds such as **2025.1.4 and earlier**, **2025.0.8 and earlier**, **2024.1.7 and earlier**, and **2024.0.0 and earlier**. The Canadian Centre for Cyber Security urged organizations to review the Progress bulletin and apply the required updates to mitigate exposure in internet-reachable file transfer automation environments.
Jun 29, 2026