CVE-2026-16138: Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-09-02
Weakness: CWE-502

Description

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

Affected products

Progress ShareFile Storage Zones Controller: before 5.12.6 — fixed in 5.12.6

How to fix

Upgrade to a fixed version: Progress ShareFile Storage Zones Controller 5.12.6. Check the vendor advisory for mitigations.

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information

Get alerted when CVE-2026-16138 or the next vulnerability affects your stack