Progress ShareFile Pre-Auth RCE Chain via Authentication Bypass and Webshell Upload (CVE-2026-2699 & CVE-2026-2701)

Progress ShareFile Pre-Auth RCE Chain via Authentication (TL-2026-0317), also tracked as WT-2026-0006, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-04. It has no confirmed attribution, affects Progress Software ShareFile Storage Zones Controller, references 2 CVEs (CVE-2026-2699, CVE-2026-2701), maps to 16 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0317

Threat ID
TL-2026-0317
Also known as
WT-2026-0006, WT-2026-0007
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-04-04
Last reviewed
2026-04-04
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
enterprise, government, financial, healthcare, legal, technology, education
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Progress ShareFile Pre-Auth RCE Chain via Authentication

Malware and tooling: watchTowr-vs-Progress-ShareFile-CVE-2026-2699

A chained exploit combining CVE-2026-2699 (authentication bypass via execution after redirect) and CVE-2026-2701 (remote code execution via unrestricted file upload) in Progress ShareFile Storage Zones Controller 5.x allows unauthenticated attackers to achieve full server compromise. Approximately 30,000 instances are internet-exposed and a full proof-of-concept exploit chain is publicly available.

How Progress ShareFile Pre-Auth RCE Chain via Authentication works

Progress ShareFile Storage Zones Controller (SZC) branch 5.x contains two critical vulnerabilities that, when chained together, enable pre-authentication remote code execution against customer-managed ShareFile deployments.

CVE-2026-2699 (CVSS 9.8) is an authentication bypass caused by an Execution After Redirect (EAR) flaw in the admin configuration interface at /ConfigService/Admin.aspx. The application uses Response.Redirect(path, false) instead of Response.Redirect(path, true), meaning the server continues rendering the full admin page content in the HTTP response body despite issuing a 302 redirect. An attacker can intercept the response and strip the Location header to access the complete admin interface without credentials. This grants the ability to modify Storage Zone configuration settings including the Network Share Location path, the zone passphrase, and the Primary Zone Controller URL.

CVE-2026-2701 (CVSS 9.1) is a remote code execution vulnerability enabling authenticated users to upload and execute arbitrary files. After exploiting CVE-2026-2699 to gain admin access, an attacker modifies the Network Share Location to point to the IIS webroot directory (e.g., C:\inetpub\wwwroot\ShareFile\StorageCenter\documentum). The attacker then crafts an upload request to /upload.aspx with the unzip=true parameter, uploading a ZIP archive containing a malicious ASPX webshell. The server extracts the ZIP contents into the web-accessible directory, placing the webshell where it can be directly accessed and executed.

The upload endpoint requires HMAC-SHA256 signature validation via the h query parameter. The attacker obtains the necessary Zone Secret by querying /ConfigService/api/StroageZoneConfig (note the typo in the actual endpoint) to leak the TempData2 value, which is then decrypted using AES with a hardcoded salt value. The decrypted Zone Secret is used to compute valid HMAC signatures for upload requests.

The exploit chain was discovered by watchTowr (tracked as WT-2026-0006 and WT-2026-0007) and reported to Progress on February 6-13, 2026. Progress released a patch in version 5.12.4 on March 10, 2026. watchTowr publicly disclosed the full chain with proof-of-concept code on April 2, 2026. Internet scanning by watchTowr identified approximately 30,000 exposed SZC instances, while the ShadowServer Foundation currently tracks approximately 700 internet-exposed instances concentrated in the United States and Europe.

Although no confirmed active exploitation has been observed as of disclosure, the availability of a complete public PoC exploit chain, combined with the large attack surface and the high value of enterprise file-sharing platforms, makes exploitation by threat actors highly likely. Progress ShareFile has been previously targeted by the Cl0p ransomware gang in 2023 (CVE-2023-24489), establishing a precedent for rapid weaponization of ShareFile vulnerabilities.

MITRE ATT&CK techniques used in TL-2026-0317

collection

T1005 Data from Local System

defense-evasion

T1036 Masquerading; T1070 Indicator Removal

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

initial-access

T1190 Exploit Public-Facing Application

impact

T1486 Data Encrypted for Impact

persistence

T1505 Server Software Component

credential-access

T1552 Unsecured Credentials

resource-development

T1587 Develop Capabilities

reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in Progress ShareFile Pre-Auth RCE Chain via Authentication

  • Progress Software — ShareFile Storage Zones Controller
    Vulnerable versions: 5.x prior to 5.12.4; 5.12.3; 5.12.2; 5.12.1; 5.12.0
    Fixed in: 5.12.4

Remediation for Progress ShareFile Pre-Auth RCE Chain via Authentication

Patches

  • Progress ShareFile Storage Zones Controller 5.12.4 (released March 10, 2026) — resolves both CVE-2026-2699 and CVE-2026-2701

Immediate actions

  • Upgrade ShareFile Storage Zones Controller to version 5.12.4 or later immediately
  • If patching is not immediately possible, restrict network access to /ConfigService/Admin.aspx and /upload.aspx endpoints via WAF or firewall rules
  • Audit IIS webroot directories for unexpected ASPX files, particularly in StorageCenter/documentum/files/ subdirectories
  • Review Storage Zone configuration for unauthorized changes to Network Share Location or Primary Zone Controller settings
  • Monitor HTTP access logs for 302 responses to /ConfigService/Admin.aspx with abnormally large response bodies (>10KB)

Workarounds

  • Block external access to /ConfigService/ and /upload.aspx endpoints at the network perimeter
  • Implement IP whitelisting for ShareFile admin interface access
  • Enable enhanced IIS request logging and forward to SIEM for anomaly detection
  • Disable ZIP extraction functionality if not operationally required by setting unzip parameter handling to deny

Longer-term hardening

  • Implement network segmentation to isolate ShareFile Storage Zones Controller from general network access
  • Deploy Web Application Firewall (WAF) rules to detect and block exploit patterns targeting ShareFile endpoints
  • Establish file integrity monitoring (FIM) on IIS webroot directories to detect unauthorized file creation
  • Conduct regular vulnerability scanning of internet-exposed ShareFile deployments
  • Evaluate migration from customer-managed ShareFile to cloud-hosted ShareFile to reduce self-managed attack surface
  • Implement anti-exploitation features including DEP, WDEG, and ASLR enforcement on ShareFile servers

CVEs associated with Progress ShareFile Pre-Auth RCE Chain via Authentication

CVE-2026-2699, CVE-2026-2701

Weaknesses (CWE) in Progress ShareFile Pre-Auth RCE Chain via Authentication

CWE-284, CWE-698, CWE-78, CWE-94, CWE-434

Timeline of Progress ShareFile Pre-Auth RCE Chain via Authentication

  • watchTowr reports CVE-2026-2699 (authentication bypass) to Progress Software
  • watchTowr reports CVE-2026-2701 (remote code execution) to Progress Software
  • watchTowr provides Python proof-of-concept demonstrating full pre-auth RCE chain to Progress
  • Progress Software confirms replication of both vulnerabilities and the chained exploit
  • CVE-2026-2699 and CVE-2026-2701 assigned; public disclosure embargo set for April 2, 2026
  • Progress releases ShareFile Storage Zones Controller version 5.12.4 fixing both vulnerabilities
  • watchTowr scans identify approximately 30,000 internet-exposed Storage Zones Controller instances; ShadowServer tracks ~700
  • NVD publishes CVE-2026-2699 (CVSS 9.8) and CVE-2026-2701 (CVSS 9.1); CIS issues Advisory 2026-030
  • watchTowr publicly discloses full technical analysis and proof-of-concept exploit code on GitHub
  • Threadlinqs Intelligence begins active tracking; no confirmed in-the-wild exploitation yet but imminent risk given public PoC
  • As of 2026-05-29, this ShareFile pre-auth RCE chain (CVE-2026-2699/2701) is patched in SZC 5.12.4 (Mar 10) and has no confirmed in-the-wild exploitation or CISA KEV listing. It stays a live concern: a full watchTowr PoC is public, ~30k self-hosted 5.x instances remain exposed, and the Cl0p precedent makes weaponization plausible.

Sources cited for Progress ShareFile Pre-Auth RCE Chain via Authentication

Threats related to Progress ShareFile Pre-Auth RCE Chain via Authentication

Detection coverage for TL-2026-0317

As of 2026-04-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0317 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats