Progress Software has taken the extraordinary step of urging customers to immediately shut down their ShareFile Storage Zone Controllers after two critical vulnerabilities (CVE-2026-2699 and CVE-2026-2701) were found under active exploitation. With no patch available for affected v5.x versions below 5.12.4, the vendor's guidance is unambiguous: power off the controllers, migrate to v6, or accept the risk of full compromise.

Vulnerability Details

CVE-2026-2699: Authentication Bypass (CVSS 9.8 Critical)

CVE-2026-2699 is an authentication bypass in the ShareFile Storage Zones Controller (SZC) web interface. The flaw stems from an "Execution After Redirect" (EAR) weakness (CWE-698) combined with improper access control (CWE-284). An unauthenticated remote attacker can access restricted configuration endpoints — specifically /ConfigService/Admin.aspx — by exploiting how the application handles redirects after authentication checks.

The vulnerability affects all customer-managed ShareFile Storage Zones Controller v5.x versions prior to 5.12.4. v6.x versions are not affected.

CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality: High (C:H)
• Integrity: High (I:H)
• Availability: High (A:H)

CVE-2026-2701: Authenticated Remote Code Execution (CVSS 9.1 Critical)

CVE-2026-2701 allows an authenticated user to upload a malicious file and achieve remote code execution. The vulnerability combines unrestricted file upload (CWE-434), OS command injection (CWE-78), and code injection (CWE-94). While this requires authentication, it chains perfectly with CVE-2026-2699: an attacker first bypasses authentication via CVE-2026-2699, then uses the authenticated session to upload a webshell via CVE-2026-2701.

CVSS 3.1 Vector (CNA/Progress): AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (Base Score 9.1) CVSS 3.1 Vector (NIST): AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Base Score 8.8)

The discrepancy arises from Progress scoring it with Privileges Required: High (PR:H) and Scope: Changed (S:C), while NIST assesses it as PR:L and S:U.

Impact Assessment

These vulnerabilities affect Progress ShareFile Storage Zones Controller v5.x versions 5.0.0 through 5.12.3. Organizations running customer-managed storage zones are at risk. The ShareFile cloud service (SaaS) is not affected.

The attack chain is devastating in its simplicity:

1. Attacker sends unauthenticated GET request to /ConfigService/Admin.aspx
2. Application fails to properly enforce authentication after redirect
3. Attacker gains administrative access to the SZC configuration
4. Attacker uploads malicious file (webshell) via authenticated file upload endpoint
5. Attacker achieves remote code execution on the underlying Windows server

Once the Storage Zone Controller is compromised, the attacker has full control over the file storage infrastructure — they can exfiltrate, modify, or destroy any data passing through that zone. Since SZC often sits in a DMZ or trusted network segment with access to internal file shares, the blast radius frequently extends beyond the controller itself.

Affected Systems

Product	Affected Versions	Fixed Version	Status
ShareFile Storage Zones Controller 5.x	5.0.0 - 5.12.3	5.12.4	Patch available
ShareFile Storage Zones Controller 6.x	None	N/A	Not affected
ShareFile Cloud (SaaS)	None	N/A	Not affected

Critical caveat: Progress has stated that v5.x versions prior to 5.12.4 that are no longer under active maintenance will not receive patches. Customers on unsupported versions must upgrade to v5.12.4 (if eligible) or migrate to v6.x.

Mitigation & Patching

Immediate Actions (Do These Now)

1. Shut down affected Storage Zone Controllers immediately if you cannot patch within hours. Progress and CISA both recommend taking controllers offline until remediated.

2. Upgrade to v5.12.4 if you are on a supported v5.x maintenance contract:

   powershell

3. Migrate to v6.x for long-term support. v6.x is architecturally different and not vulnerable to these CVEs.

4. Block external access to SZC management interfaces at the network perimeter:

   powershell

5. Enable VPN-only access for SZC administration. Never expose /ConfigService/ endpoints to the internet.

Detection

watchTowr Labs has released a detection artifact generator that checks for CVE-2026-2699:

The tool sends a GET request to /ConfigService/Admin.aspx and reports:

• PROBABLY VULNERABLE — endpoint accessible without authentication (status 200)
• PROBABLY NOT VULNERABLE — returns 403 Forbidden

Suricata rule for network detection:

YARA rule for webshell detection (post-exploitation):

Long-Term Hardening

1. Implement network segmentation: Place SZC in isolated VLAN with no direct internet access
2. Enforce MFA for all administrative access to storage infrastructure
3. Enable audit logging on SZC and forward to SIEM
4. Schedule regular vulnerability scans targeting storage infrastructure
5. Maintain vendor support contracts to ensure timely patch access

Frequently Asked Questions

Is ShareFile Cloud (SaaS) affected?

No. Only customer-managed (on-premises) Storage Zones Controller v5.x deployments are vulnerable. The ShareFile cloud service is not affected.

What if I'm on v5.11 and my support contract expired?

You have two options: renew your maintenance contract to access the v5.12.4 patch, or migrate to v6.x. Running an unpatched, unsupported version is not viable given active exploitation.

Can I just block the /ConfigService/Admin.aspx endpoint?

Blocking this specific path mitigates CVE-2026-2699 but not CVE-2026-2701. The authentication bypass may have other vectors. The only complete fix is upgrading.

How do I know if I've been compromised?

Check for:

• Unexpected files in SZC web directories (especially .aspx, .ashx, .php)
• Unusual outbound connections from SZC servers
• Authentication logs showing access to /ConfigService/Admin.aspx from unknown IPs

Key Takeaways

• Two critical CVEs (CVE-2026-2699 CVSS 9.8, CVE-2026-2701 CVSS 9.1) chain for unauthenticated RCE on ShareFile Storage Zone Controllers
• Progress says "shut it down" — no patch for unsupported v5.x versions; immediate shutdown or migration required
• Affects v5.0.0–5.12.3 only; v6.x and SaaS are safe
• Detection is trivial: unauthenticated GET to /ConfigService/Admin.aspx returns 200 if vulnerable
• Patch now or power off — this is not a vulnerability to defer

Conclusion

The Progress ShareFile dual zero-day represents a worst-case scenario for enterprise file sharing infrastructure: a vendor telling customers to literally power off their servers because no patch exists for their version. This "no-patch shutdown" advisory tier demands immediate executive attention. If your organization runs ShareFile Storage Zones Controller v5.x, treat this as a P0 incident — invoke your incident response plan, isolate the controllers, and execute the upgrade or migration without delay. The alternative is handing attackers the keys to your file storage kingdom.

---

Sources:

• NVD CVE-2026-2699
• NVD CVE-2026-2701
• Progress ShareFile Security Advisory
• watchTowr Labs Detection Tool
• CISA Alert on Progress ShareFile
• Help Net Security: Progress ShareFile Shutdown
• SecurityWeek: Progress ShareFile Storage Zone Controller Shutdown