Progress Software has issued an urgent advisory telling all ShareFile customers to immediately shut down their self-hosted Storage Zone Controllers over a "credible external security threat." The emergency directive comes after security researchers at watchTowr Labs discovered a critical pre-authentication remote code execution (RCE) chain tracked as CVE-2026-2699 and CVE-2026-2701. No patch is currently available.

The warning went public on July 10, 2026, when a customer posted Progress's email to Reddit, and the company later confirmed the action on its status page. This is not a routine security update -- it is a pull-the-plug emergency affecting every organization running a self-hosted ShareFile Storage Zone Controller.

Vulnerability Details

The two flaws discovered by watchTowr Labs form a deadly attack chain:

CVE-2026-2699 -- A pre-authentication vulnerability in the Storage Zone Controller's web interface that allows an unauthenticated attacker to send crafted HTTP requests to the server. The specific mechanism involves improper input validation in the ASP.NET application that powers the controller.

CVE-2026-2701 -- A second flaw that, when chained with CVE-2026-2699, achieves full remote code execution on the target server without any authentication. The chain bypasses all access controls that normally protect the administrative interface.

Together, these CVEs enable an attacker to execute arbitrary commands on the Storage Zone Controller from across the internet, with no credentials required. The watchTowr team published a detailed technical writeup titled "You're Not Supposed To ShareFile With Everyone" that documents the full exploitation chain.

The Storage Zone Controller sits at the network edge, typically exposed to the internet so that ShareFile clients can reach it. That architectural decision is precisely what makes this so dangerous -- every internet-facing controller is potentially exploitable right now.

Impact Assessment

The impact of this vulnerability chain is severe:

• Remote Code Execution: An attacker can execute arbitrary code on the controller with the privileges of the web application (typically NETWORK SERVICE or similar).
• File Exfiltration: The Storage Zone Controller manages file storage -- successful exploitation gives attackers access to all files stored in the zone.
• Lateral Movement: Once inside the controller, an attacker can potentially pivot to the internal network, since the controller must communicate with Active Directory, file servers, and other internal resources.
• Data Integrity: Beyond reading files, attackers could modify, encrypt, or delete business-critical documents.

Progress has been careful to note that it has "no indication of unauthorized access to any ShareFile accounts or data" -- but that statement applies to the cloud service itself, not the compromised controllers. The wording suggests Progress is monitoring its own infrastructure while the threat to self-hosted controllers remains uncontained.

Affected Systems

The emergency applies specifically to self-hosted ShareFile Storage Zone Controllers running on Windows Server. These are the on-premises servers that organizations deploy to keep their file storage local while still using the ShareFile cloud service for management and client access.

If you use ShareFile exclusively through the cloud (standard ShareFile accounts without a self-hosted zone), you are not directly affected by this vulnerability. However, you should verify that your organization does not operate any Storage Zone Controllers in remote offices or subsidiary environments.

Progress has stated that only the Storage Zone Controller is impacted, not standard cloud-only ShareFile accounts.

Mitigation & Patching

The situation is unusual because there is no patch. Progress has not released a fix and has instead ordered an immediate shutdown. Here is the action plan:

Step 1: Shut Down Immediately

Power off or disconnect your Storage Zone Controller(s) from the network right now. Progress has confirmed that it temporarily disabled access to affected accounts as a precaution. Do not wait for a patch -- the "credible threat" language implies active risk.

Step 2: Treat as a Security Incident

If the controller was reachable from the internet, assume it may already be compromised. Follow these steps:

• Preserve system logs, IIS logs, and event logs for forensic analysis
• Check for unfamiliar .aspx files in the web root (a common post-exploitation indicator)
• Run an antivirus scan with up-to-date definitions
• Review Active Directory authentication logs for anomalous activity from the controller
• Check firewall logs for unexpected outbound connections from the controller's IP address

Step 3: Verify Your Current Version

Confirm which version of the Storage Zone Controller software you were running. The current patched versions are 5.12.4 (5.x line) and any 6.x release. These versions fix vulnerabilities that were disclosed and patched earlier this year by Progress in March 2026, but Progress has not confirmed that they protect against the current threat.

Step 4: Wait for Official Guidance

Monitor Progress's status page and security advisories for:

• A detailed description of the threat
• A patch release timeline
• Safe restart criteria
• Any Indicators of Compromise (IOCs)

Step 5: Prepare for Extended Outage

Given the severity, expect the controllers to remain offline for days or longer. Plan for alternative file-sharing workflows. This may involve:

• Temporarily migrating users to cloud-only ShareFile access
• Using an alternative secure file transfer solution
• Implementing manual approval workflows for sensitive file exchanges

Background: A Pattern of File-Transfer Vulnerabilities

This is not Progress Software's first file-transfer security crisis. In 2023, the company's MOVEit Transfer product was hit by a zero-day vulnerability exploited by the Clop ransomware group, affecting over 2,700 organizations worldwide. The attack caused billions in damages and became one of the largest data theft incidents in history.

The ShareFile Storage Zone Controller itself has a history of security issues. In 2023, while the product was still owned by Citrix, an unauthenticated flaw (CVE-2023-24489) was exploited in the wild, prompting Citrix to cut off unpatched controllers from the ShareFile cloud -- the same access block Progress has now imposed in its acquisition.

Progress acquired ShareFile from Citrix in 2024. The two critical Storage Zone Controller flaws that watchTowr disclosed and Progress patched in March 2026 (unrelated to the current threat) further underscore the ongoing security challenges facing this product.

Frequently Asked Questions

Q: Is my cloud-only ShareFile account affected? A: No. Only self-hosted Storage Zone Controller servers are affected. Standard ShareFile cloud accounts continue to operate normally.

Q: Has anyone been exploited yet? A: Progress has not confirmed active exploitation, but the "credible external security threat" language suggests at least a credible risk of imminent exploitation, if not confirmed attacks.

Q: When will a patch be available? A: Progress has not announced a timeline. The shutdown order itself suggests that a fix is not imminent -- the company would have released a patch if one were ready.

Q: Can I apply network restrictions instead of shutting down? A: While restricting network access to trusted IPs reduces the attack surface, Progress has explicitly ordered a shutdown. Partial mitigations may not address the root cause, and the pre-auth nature of the vulnerability means any attacker who can reach the controller can exploit it.

Q: How do the March 2026 patches relate to this? A: The March patches (also from watchTowr disclosures) addressed different vulnerabilities. Progress has not stated that those patches protect against the current threat.

Q: Should I be concerned about the MOVEit connection? A: While the threat is unrelated to MOVEit, Progress Software's history with file-transfer security makes it prudent to assume the worst and follow the shutdown order strictly.

Key Takeaways

• Progress Software has ordered an urgent shutdown of all self-hosted ShareFile Storage Zone Controllers
• A pre-auth RCE chain (CVE-2026-2699, CVE-2026-2701) was discovered by watchTowr Labs
• No patch is available -- the shutdown is the only mitigation
• Cloud-only ShareFile accounts are not affected
• Treat any internet-exposed controller as potentially compromised
• Monitor Progress's status page for updates and patch announcements
• Plan for extended disruption to self-hosted ShareFile workflows

Conclusion

The Progress ShareFile emergency is a textbook example of the most dangerous kind of vulnerability: a pre-authentication RCE chain with no patch available, affecting internet-facing infrastructure that handles sensitive business data. For IT teams, the instruction is unusually stark -- shut it down, not patch it. Follow that order, preserve evidence, and watch for Progress's next communication. The history of file-transfer security incidents, from MOVEit to Citrix ShareFile, makes clear that these systems are prized targets for attackers, and the response must match the severity of the threat.

---

Sources: The Hacker News, BleepingComputer, watchTowr Labs, Progress Software Status Page