Loading story…
Citrix ShareFile StorageZones Controller versions before 5.11.24 are vulnerable to unauthenticated remote code execution tracked as CVE-2023-24489. The flaw affects the /documentum/upload.aspx endpoint, where a cryptographic weakness combined with path traversal can allow an unauthenticated attacker to upload arbitrary files into the webroot.
An attacker could use the issue to deploy a web shell, execute commands on the StorageZones Controller host, and potentially pivot to other systems through lateral movement or privilege escalation. Organizations running self-managed ShareFile StorageZones Controller should upgrade to 5.11.24 or later and investigate exposed or unpatched instances for suspicious uploads and web-shell activity.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers detailed how CVE-2023-24489 can be exploited by using an AES-CBC/PKCS#7 padding-validation oracle to supply a parentid value that passes decryption checks. Combined with traversal in uploadid, the technique uploads an ASPX web shell into the IIS webroot and executes commands as the IIS application identity.
Citrix recommended upgrading ShareFile Storage Zones Controller to version 5.11.24 or later to remediate CVE-2023-24489.
A pre-authentication remote code execution vulnerability, CVE-2023-24489, was identified in ShareFile Storage Zones Controller versions before 5.11.24. The issue combines a cryptographic flaw and path traversal in /documentum/upload.aspx, allowing arbitrary webroot file uploads and potential web-shell execution; Assetnote Security Research Team was credited with discovery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a **pre-authenticated remote code execution** chain affecting **Progress ShareFile Storage Zone Controller 5.x**. The chain combines **CVE-2026-2699**, an authentication bypass in `/ConfigService/Admin.aspx` caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious **ASPX webshell** to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments. The issues were reported by watchTowr and fixed by Progress in **ShareFile Storage Zone Controller 5.12.4**. The research focused on the **5.x** branch, including version **5.12.3**, and highlighted substantial internet exposure: watchTowr said roughly **30,000** Storage Zone Controller instances were discoverable online, while Shadowserver observed about **700** internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Jun 29, 2026
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026
Progress Software disclosed a zero-day path traversal vulnerability in **ShareFile Storage Zones Controller** tracked as `CVE-2026-15724`, after previously advising customers to shut down affected servers. The flaw affects all `5.x` releases through `5.12.4` and `6.0.0` through `6.0.1`, and allows an authenticated administrator to read arbitrary files, write attacker-controlled data to arbitrary directories, and determine whether files exist on the server. The issue carries a CVSS v3.1 vector of `AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N` and is associated with `CWE-22`, `CWE-20`, and `CWE-73`. Progress said it learned of a potential threat from a trusted source, identified the previously unknown bug during its investigation, and prepared fixes before public disclosure. The company released patched versions **5.12.5** and **6.0.2**, stating that updated servers can be brought back online, while the Canadian Centre for Cyber Security urged organizations to review Progress guidance and apply the necessary updates. Progress also said it has found no evidence so far of customer compromise, unauthorized access to ShareFile accounts or data, or active exploitation affecting customers.
Aug 17, 2026