ShareFile Flaws Could Enable Unauthenticated Remote Code Execution
Summary
WatchTowr says two ShareFile flaws can be chained for unauthenticated RCE. ShareFile addressed them in version 5.12.4; versions 6.x are not affected.
Key points
- CVE-2026-2699 (CVSS 9.8) reportedly lets unauthenticated attackers access restricted configuration pages through an Execution After Redirect flaw.
- WatchTowr says attackers could use the flaw to alter Storage Zone settings and redirect a victim controller to a zone they control.
- The configuration access could allow files to be routed to an attacker-controlled repository or uploaded to arbitrary locations.
- CVE-2026-2701 (CVSS 9.1) is an arbitrary file upload flaw that WatchTowr used to place a web shell and achieve RCE.
- WatchTowr reports chaining the two flaws for unauthenticated RCE; the article does not report confirmed exploitation in the wild.
- ShareFile addressed both issues in version 5.12.4; versions 6.x are not affected.
Article Details
- Vulnerability Types
- Execution After Redirect (EAR)
- Arbitrary file upload
- Severity
- Critical (CVSS 9.8 and 9.1)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe two vulnerabilities were chained to achieve unauthenticated remote code execution on a vulnerable ShareFile instance.T1505.003 · Web ShellThe arbitrary file upload vulnerability was used to drop a web shell and achieve remote code execution.T1567.002 · Exfiltration to Cloud StorageWatchTowr described configuring a victim Storage Zone to send synced or uploaded files to an AWS S3 bucket under its control.
CVE
CVE-2026-2699Progress · ShareFile Storage Zones ControllerOne of the bugs, tracked as CVE-2026-2699 (CVSS score of 9.8), allows unauthenticated attackers to access configuration pages that should be restricted.CVE-2026-2701Vendor / Product unavailableDigging through the application’s file upload functionality, WatchTowr discovered CVE-2026-2701 (CVSS score of 9.1), an arbitrary file upload issue it could exploit to drop a web shell and achieve RCE.