What’s Vulnerable › Vulnerabilities

CVE-2026-2699: EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 58.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-02 · updated 2026-10-26
• Weakness: CWE-284

Description

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Affected products

• Progress ShareFile Storage Zones Controller: from 5.0.0 before 5.12.4 — fixed in 5.12.4

How to fix

Upgrade to a fixed version: Progress ShareFile Storage Zones Controller 5.12.4. Check the vendor advisory for mitigations.

In the news

• You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)

References

• https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26
• https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699

Get alerted when CVE-2026-2699 or the next vulnerability affects your stack