cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Progress ShareFile Flaws Enable Unauthenticated RCE Through Chained Exploits

· Original article ↗

Summary

watchTowr says two ShareFile Storage Zones Controller flaws can be chained for unauthenticated access and remote code execution. Progress fixed them in version 5.12.4; no active exploitation was observed.

Key points

  • CVE-2026-2699 is an authentication bypass that can expose the ShareFile admin interface.
  • Researchers say attackers can use the bypass to modify storage-zone settings and control passphrase-related values and secrets.
  • CVE-2026-2701 enables remote code execution by abusing file upload and extraction to place ASPX webshells in the application webroot.
  • The flaws affect the Storage Zones Controller component in ShareFile branch 5.x.
  • Progress fixed the vulnerabilities in ShareFile 5.12.4; exposed instances should be updated.
  • No active exploitation had been observed at the time of the report. watchTowr estimated about 30,000 exposed instances, while Shadowserver observed 700.

Article Details

Vulnerability Types
  • Authentication bypass
  • Remote code execution
Severity
Unknown
Affected Versions
  • Progress ShareFile Storage Zones Controller 5.x
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationCVE-2026-2699 is used to bypass authentication and access the Progress ShareFile admin interface.T1505.003 · Web ShellThe CVE-2026-2701 exploit chain places malicious ASPX webshells in the application webroot to achieve remote code execution.

CVE

CVE-2026-2699Progress · ShareFile Storage Zones ControllerThe flaws (CVE-2026-2699 and CVE-2026-2701) were reported by watchTowr and fixed in Progress ShareFile 5.12.4 on March 10, but exposed instances should be patched immediately.CVE-2026-2701Progress · ShareFile Storage Zones ControllerThe flaws (CVE-2026-2699 and CVE-2026-2701) were reported by watchTowr and fixed in Progress ShareFile 5.12.4 on March 10, but exposed instances should be patched immediately.

Vendors

Progress SoftwareTwo vulnerabilities in Progress ShareFile’s Storage Zones Controller can be chained to enable unauthenticated file exfiltration and remote code execution on affected systems.

Products

Progress ShareFileTwo vulnerabilities in Progress ShareFile’s Storage Zones Controller can be chained to enable unauthenticated file exfiltration and remote code execution on affected systems.Storage Zones ControllerTwo vulnerabilities in Progress ShareFile’s Storage Zones Controller can be chained to enable unauthenticated file exfiltration and remote code execution on affected systems.

Related Articles