Loading story…
Progress Software disclosed a zero-day path traversal vulnerability in ShareFile Storage Zones Controller tracked as CVE-2026-15724, after previously advising customers to shut down affected servers. The flaw affects all 5.x releases through 5.12.4 and 6.0.0 through 6.0.1, and allows an authenticated administrator to read arbitrary files, write attacker-controlled data to arbitrary directories, and determine whether files exist on the server. The issue carries a CVSS v3.1 vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N and is associated with CWE-22, CWE-20, and CWE-73.
Progress said it learned of a potential threat from a trusted source, identified the previously unknown bug during its investigation, and prepared fixes before public disclosure. The company released patched versions 5.12.5 and 6.0.2, stating that updated servers can be brought back online, while the Canadian Centre for Cyber Security urged organizations to review Progress guidance and apply the necessary updates. Progress also said it has found no evidence so far of customer compromise, unauthorized access to ShareFile accounts or data, or active exploitation affecting customers.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
When disclosing the issue, Progress stated it had not found evidence of customer compromise, unauthorized access to ShareFile accounts or data, or any active threats. The source ties this statement to the disclosure but does not explicitly anchor it to a separate event date beyond the advisory publication.
On 2026-07-21, Progress published security advisories for ShareFile Storage Zones Controller covering the path traversal flaw later tracked as CVE-2026-15724. The company released fixed versions 5.12.5 and 6.0.2 and said patched servers could be brought back online.
Progress disclosed that it had issued emergency guidance to shut down ShareFile Storage Zone Controller servers because of the zero-day vulnerability. The source does not provide a specific date for when the shutdown guidance was first issued.
Progress said it received information about a potential threat from a trusted source, investigated, identified a previously unknown ShareFile Storage Zone Controller vulnerability, and prepared a fix before public disclosure. No specific event date was provided in the source content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcexakep.ru
Open sourcesupport.sharefile.com
Open sourceprogress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a **pre-authenticated remote code execution** chain affecting **Progress ShareFile Storage Zone Controller 5.x**. The chain combines **CVE-2026-2699**, an authentication bypass in `/ConfigService/Admin.aspx` caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious **ASPX webshell** to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments. The issues were reported by watchTowr and fixed by Progress in **ShareFile Storage Zone Controller 5.12.4**. The research focused on the **5.x** branch, including version **5.12.3**, and highlighted substantial internet exposure: watchTowr said roughly **30,000** Storage Zone Controller instances were discoverable online, while Shadowserver observed about **700** internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Jun 29, 2026
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026
Progress Software warned ShareFile customers using on-premises **Storage Zone Controllers** to immediately shut down the Windows servers hosting those systems after identifying a **credible external security threat**. The company also temporarily disabled access to ShareFile accounts that rely on those controllers as a precaution while it investigates with internal and external cybersecurity experts. Progress said it had **no indication of unauthorized access** to ShareFile accounts or data at the time of the notice. The alert affects hybrid ShareFile deployments where Internet-accessible Storage Zone Controllers broker file transfers between the ShareFile cloud service and customer-managed local storage. Progress did not disclose whether the threat is active exploitation, a zero-day, or a related issue tied to earlier ShareFile flaws, but the warning follows recently patched vulnerabilities **`CVE-2026-2699`** and **`CVE-2026-2701`**, which could be chained to bypass authentication, upload malicious **ASPX webshells**, and achieve remote code execution; those issues were fixed in **version 5.12.4**, while the **6.x .NET Core** branch was reported as unaffected.
Aug 11, 2026