CVE-2026-2701

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 54.54%
EPSS Percentile: 99.02%
CISA KEV: Not listed

Description

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 02-Apr-2026 21:16
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-06
CWE: CWE-78, CWE-94, CWE-434

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Progress · ShareFile Storage Zones Controller Source: CNA · [email protected]
Default status: unaffected

0 ≤ version ≤ 5.12.3 — affected (semver)

Affected Products / Versions

progress / sharefile_storage_zones_controller Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · before (exclusive) 5.12.4
cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 07-Nov-2026 07:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Digging through the application’s file upload functionality, WatchTowr discovered CVE-2026-2701 (CVSS score of 9.1), an arbitrary file upload issue it could exploit to drop a web shell and achieve RCE. ShareFile Flaws Could Enable Unauthenticated Remote Code Execution
WatchTower Labs disclosed a pre-auth RCE chain in Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) with fixes in Storage Zone Controller 5.12.4 affecting ~30,000 instances. ThreatsDay Roundup Covers ShareFile RCE Flaws, Android Rootkit and CloudTrail Evasion
The flaws (CVE-2026-2699 and CVE-2026-2701) were reported by watchTowr and fixed in Progress ShareFile 5.12.4 on March 10, but exposed instances should be patched immediately. Progress ShareFile Flaws Enable Unauthenticated RCE Through Chained Exploits

CVE (1)

Malware (5)

People (1)

Threat Actors (3)

MITRE ATT&CK (5)

Vendors (6)

Products (13)

Industries (1)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.