# Progress ShareFile Pre-Auth RCE Chain via Authentication Bypass and Webshell Upload (CVE-2026-2699 & CVE-2026-2701)

> A chained exploit combining CVE-2026-2699 (authentication bypass via execution after redirect) and CVE-2026-2701 (remote code execution via unrestricted file upload) in Progress ShareFile Storage Zones Controller 5.x allows unauthenticated attackers to achieve full server compromise. Approximately 30,000 instances are internet-exposed and a full proof-of-concept exploit chain is publicly available.

- **Published:** 2026-04-04T12:00:00Z
- **Last reviewed:** 2026-04-04T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0317
- **ID:** TL-2026-0317
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-2699, CVE-2026-2701

## Description

Progress ShareFile Storage Zones Controller (SZC) branch 5.x contains two critical vulnerabilities that, when chained together, enable pre-authentication remote code execution against customer-managed ShareFile deployments.

CVE-2026-2699 (CVSS 9.8) is an authentication bypass caused by an Execution After Redirect (EAR) flaw in the admin configuration interface at /ConfigService/Admin.aspx. The application uses Response.Redirect(path, false) instead of Response.Redirect(path, true), meaning the server continues rendering the full admin page content in the HTTP response body despite issuing a 302 redirect. An attacker can intercept the response and strip the Location header to access the complete admin interface without credentials. This grants the ability to modify Storage Zone configuration settings including the Network Share Location path, the zone passphrase, and the Primary Zone Controller URL.

CVE-2026-2701 (CVSS 9.1) is a remote code execution vulnerability enabling authenticated users to upload and execute arbitrary files. After exploiting CVE-2026-2699 to gain admin access, an attacker modifies the Network Share Location to point to the IIS webroot directory (e.g., C:\inetpub\wwwroot\ShareFile\StorageCenter\documentum). The attacker then crafts an upload request to /upload.aspx with the unzip=true parameter, uploading a ZIP archive containing a malicious ASPX webshell. The server extracts the ZIP contents into the web-accessible directory, placing the webshell where it can be directly accessed and executed.

The upload endpoint requires HMAC-SHA256 signature validation via the h query parameter. The attacker obtains the necessary Zone Secret by querying /ConfigService/api/StroageZoneConfig (note the typo in the actual endpoint) to leak the TempData2 value, which is then decrypted using AES with a hardcoded salt value. The decrypted Zone Secret is used to compute valid HMAC signatures for upload requests.

The exploit chain was discovered by watchTowr (tracked as WT-2026-0006 and WT-2026-0007) and reported to Progress on February 6-13, 2026. Progress released a patch in version 5.12.4 on March 10, 2026. watchTowr publicly disclosed the full chain with proof-of-concept code on April 2, 2026. Internet scanning by watchTowr identified approximately 30,000 exposed SZC instances, while the ShadowServer Foundation currently tracks approximately 700 internet-exposed instances concentrated in the United States and Europe.

Although no confirmed active exploitation has been observed as of disclosure, the availability of a complete public PoC exploit chain, combined with the large attack surface and the high value of enterprise file-sharing platforms, makes exploitation by threat actors highly likely. Progress ShareFile has been previously targeted by the Cl0p ransomware gang in 2023 (CVE-2023-24489), establishing a precedent for rapid weaponization of ShareFile vulnerabilities.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [watchTowr Technical Analysis — Progress ShareFile Pre-Auth RCE Chain](https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/)
- [watchTowr PoC Exploit Code (GitHub)](https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699)
- [Progress Security Advisory — ShareFile SZC Vulnerability Feb 2026](https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26)
- [NVD — CVE-2026-2699 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-2699)
- [NVD — CVE-2026-2701 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-2701)
- [BleepingComputer — New Progress ShareFile flaws can be chained in pre-auth RCE attacks](https://www.bleepingcomputer.com/news/security/new-progress-sharefile-flaws-can-be-chained-in-pre-auth-rce-attacks/)
- [CIS Advisory 2026-030 — Multiple Vulnerabilities in Progress ShareFile](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-progress-sharefile-could-allow-for-remote-code-execution_2026-030)
- [SOCRadar — Progress ShareFile Flaws CVE-2026-2699 & CVE-2026-2701 RCE](https://socradar.io/blog/progress-sharefile-cve-2026-2699-2701-rce/)
- [Beazley Security Alert — Critical Vulnerabilities in Progress ShareFile](https://beazley.security/alerts-advisories/critical-vulnerabilities-in-progress-sharefile-cve-2026-2699-cve-2026-2701)
- [runZero — Progress ShareFile RCE vulnerabilities: Find impacted assets](https://www.runzero.com/blog/progress-sharefile/)
- [Cybersecurity Dive — Researchers warn of critical flaws in Progress ShareFile](https://www.cybersecuritydive.com/news/researchers-critical-flaws-progress-sharefile/816599/)
- [Field Effect — Chained CVEs in ShareFile SZC enable pre-authentication compromise](https://fieldeffect.com/blog/chained-cves-sharefile-szc)
- [Progress ShareFile Security Page](https://www.progress.com/security/sharefile)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0317