CVE-2026-2699

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 58.39%
EPSS Percentile: 99.10%
CISA KEV: Not listed

Description

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 02-Apr-2026 21:16
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-06
CWE: CWE-284, CWE-698

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Progress · ShareFile Storage Zones Controller Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 5.12.3 — affected (semver)

Affected Products / Versions

progress / sharefile_storage_zones_controller Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · before (exclusive) 5.12.4
cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*

References

Last enrichment sync: 07-Nov-2026 07:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

One of the bugs, tracked as CVE-2026-2699 (CVSS score of 9.8), allows unauthenticated attackers to access configuration pages that should be restricted. ShareFile Flaws Could Enable Unauthenticated Remote Code Execution
WatchTower Labs disclosed a pre-auth RCE chain in Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) with fixes in Storage Zone Controller 5.12.4 affecting ~30,000 instances. ThreatsDay Roundup Covers ShareFile RCE Flaws, Android Rootkit and CloudTrail Evasion
The flaws (CVE-2026-2699 and CVE-2026-2701) were reported by watchTowr and fixed in Progress ShareFile 5.12.4 on March 10, but exposed instances should be patched immediately. Progress ShareFile Flaws Enable Unauthenticated RCE Through Chained Exploits

CVE (1)

Malware (5)

People (1)

Threat Actors (3)

MITRE ATT&CK (5)

Vendors (6)

Products (13)

Industries (1)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.