As cited
Copy frozen at (site build).
vulnerabilities
You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)
Researchers discovered and chained two vulnerabilities in Progress ShareFile's Storage Zone Controller (an on-premises gateway managing file transfers) to achieve unauthenticated remote code execution. The flaws, CVE-2026-2699 (authentication bypass) and CVE-2026-2701 (remote code execution), affected version 5.12.3 on the ASP.NET branch and were patched in version 5.12.4 released March 10, 2026. Approximately 30,000 Storage Zone Controller instances are exposed on the internet.
Why it matters: Organizations using ShareFile Storage Zone Controller (on-premises deployments for data sovereignty or regulatory reasons) must upgrade to version 5.12.4 immediately, as the vulnerability allows complete system compromise without authentication and file transfer appliances remain high-value targets for ransomware and APT groups.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)
Researchers discovered and chained two vulnerabilities in Progress ShareFile's Storage Zone Controller (an on-premises gateway managing file transfers) to achieve unauthenticated remote code execution. The flaws, CVE-2026-2699 (authentication bypass) and CVE-2026-2701 (remote code execution), affected version 5.12.3 on the ASP.NET branch and were patched in version 5.12.4 released March 10, 2026. Approximately 30,000 Storage Zone Controller instances are exposed on the internet.
Why it matters: Organizations using ShareFile Storage Zone Controller (on-premises deployments for data sovereignty or regulatory reasons) must upgrade to version 5.12.4 immediately, as the vulnerability allows complete system compromise without authentication and file transfer appliances remain high-value targets for ransomware and APT groups.
- Source published
- First seen by Cybersecurity Tracker