Progress ShareFile Zero-Day Path Traversal Flaw Forces Storage Zone Controller Shutdown
Progress ShareFile Zero-Day Path Traversal Flaw Forces (TL-2026-1317) is a high-severity software vulnerability, first published 2026-07-14. It has no confirmed attribution, affects Progress Software ShareFile Storage Zones Controller, maps to 15 MITRE ATT&CK techniques (T1005, T1068, T1078), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1317
- Threat ID
- TL-2026-1317
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors using on-premises managed file transfer, government administration, financial services, health, legal, professional services
- Target regions
- united states of america, Europe, germany
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Progress ShareFile Zero-Day Path Traversal Flaw Forces
Malware and tooling: ASPX webshell (unnamed/generic), watchTowr-vs-Progress-ShareFile-CVE-2026-2699 (public PoC)
Progress Software confirmed a zero-day path traversal vulnerability in ShareFile Storage Zone Controller (versions 5.x and 6.x) that lets an authenticated administrative user read arbitrary files, write attacker-controlled content to arbitrary directories, or enumerate server filesystem layout. The vendor took storage zones offline as a precaution and shipped out-of-band fixes in versions 5.12.5 and 6.0.2.
How Progress ShareFile Zero-Day Path Traversal Flaw Forces works
On 2026-07-10, Progress Software emailed ShareFile customers warning of a "credible external security threat" targeting Storage Zone Controllers (SZC) — customer-managed Windows servers that provide on-premises file storage while relying on ShareFile's cloud-based authentication, permissions, auditing, and collaboration layer. Progress ordered an immediate manual shutdown of affected Windows servers and temporarily disabled access to ShareFile accounts using Storage Zone Controllers, without initially disclosing the technical nature of the threat. The incident became public after a customer posted Progress's notification email to Reddit's r/sysadmin; Progress's status page listed Storage Zone Controller as "not operational" from 12:12pm EDT that day.
On 2026-07-14, Progress confirmed the root cause: a zero-day path traversal vulnerability in the SZC codebase (versions 5.x and 6.x) that allows an authenticated administrative user to (1) read arbitrary files accessible to the application's IIS service account, (2) write threat-actor-controlled content to arbitrary directories on the host filesystem, and (3) enumerate the full server filesystem layout. Progress shipped out-of-band patches in versions 5.12.5 and 6.0.2, and states it has no evidence of unauthorized customer access or active exploitation of this specific flaw. A CVE identifier has been reserved but is not expected to publish for roughly two weeks.
This disclosure lands squarely in the shadow of a separate, already-public pre-authentication RCE chain in the same product line: CVE-2026-2699 (CVSS 9.8, authentication bypass via Execution-After-Redirect in `/ConfigService/Admin.aspx`) and CVE-2026-2701 (CVSS 9.1, arbitrary file upload leading to ASPX webshell RCE), disclosed by watchTowr Labs on 2026-04-02 after a responsible-disclosure window, and patched in 5.12.4 (2026-03-10). Shadowserver Foundation's honeypots recorded the first in-the-wild exploitation attempts against CVE-2026-2699 on 2026-07-11 — one day after Progress's shutdown order and three days before the new zero-day was confirmed. Progress has explicitly stated it has NOT connected the July shutdown/zero-day to CVE-2026-2699/CVE-2026-2701, and neither of those CVEs has been added to the CISA KEV catalog as of this writing, but the close timing, shared component (Storage Zone Controller), and shared threat class (path/file-handling abuse of the customer-managed on-prem SZC tier) warrant continued correlation. ShareFile Storage Zone Controllers are typically internet-reachable at the network edge (they broker file transfers between the ShareFile cloud platform and customer-managed storage), with watchTowr estimating ~30,000 internet-facing instances and Shadowserver counting 700-784 confirmed exposed hosts concentrated in the US and Europe/Germany.
The incident draws direct comparisons in press coverage to the 2023 Clop ransomware group's mass exploitation of a zero-day in Progress MOVEit Transfer (CVE-2023-34362), another Progress-owned managed-file-transfer product with a history of severe, actively-exploited vulnerabilities. Progress committed to providing customers an update within 24 hours of its initial 2026-07-10 notification and continues to recommend keeping controllers offline pending full guidance, verifying patch currency, and — for internet-reachable instances — treating the event as a potential incident: preserving logs and auditing webroots for unfamiliar `.aspx` files.
MITRE ATT&CK techniques used in TL-2026-1317
Collection
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth
persistence
Credential Access
T1552.001 Credentials In Files
Impact
T1565.001 Stored Data Manipulation
Resource Development
Reconnaissance
T1595.001 Scanning IP Blocks; T1595.002 Vulnerability Scanning
Affected products and versions in Progress ShareFile Zero-Day Path Traversal Flaw Forces
- Progress Software — ShareFile Storage Zones Controller
Vulnerable versions: 5.x (through 5.12.4); 6.x (through 6.0.1)
Fixed in: 5.12.5; 6.0.2
Remediation for Progress ShareFile Zero-Day Path Traversal Flaw Forces
Patches
- ShareFile Storage Zone Controller 5.12.5
- ShareFile Storage Zone Controller 6.0.2
Immediate actions
- Apply ShareFile Storage Zone Controller 5.12.5 (5.x branch) or 6.0.2 (6.x branch) immediately
- Keep affected Windows servers offline until patched and validated, per Progress's precautionary shutdown guidance
- Audit ShareFile webroot directories (e.g. C:\inetpub\wwwroot\ShareFile\StorageCenter\) for unfamiliar or unexpected .aspx files indicating webshell deployment
- Review IIS access logs for anomalous POST requests to /ConfigService/Admin.aspx and /upload.aspx originating from external/unfamiliar IP addresses
- Preserve logs on internet-reachable Storage Zone Controllers and treat as a potential incident pending Progress's full technical disclosure
Workarounds
- Manually shut down Windows servers hosting Storage Zone Controllers until patched (vendor-mandated precaution issued 2026-07-10)
- Temporarily disable ShareFile account access that relies on Storage Zone Controllers
Longer-term hardening
- Restrict or remove direct internet exposure of Storage Zone Controller admin/config interfaces; place behind VPN or IP allow-listing
- Rotate Zone Secrets, storage passphrases, and any credentials handled by the SZC following patch deployment
- Apply defense-in-depth (WAF, network segmentation, EDR on file-transfer edge hosts) given the repeated pattern of severe on-prem MFT vulnerabilities across the Progress product line (MOVEit, ShareFile)
- Monitor CISA KEV and Shadowserver reporting for confirmation of whether this path traversal flaw or CVE-2026-2699/CVE-2026-2701 reach confirmed active exploitation status
- Subscribe to Progress ShareFile security advisories for the pending CVE publication (~2 weeks post-disclosure) and any follow-up guidance
Weaknesses (CWE) in Progress ShareFile Zero-Day Path Traversal Flaw Forces
CWE-22
Timeline of Progress ShareFile Zero-Day Path Traversal Flaw Forces
- watchTowr Labs privately reports CVE-2026-2699 (Execution-After-Redirect authentication bypass) in ShareFile Storage Zone Controller's /ConfigService/Admin.aspx to Progress Software.
- watchTowr Labs privately reports CVE-2026-2701 (arbitrary file upload leading to RCE via ASPX webshell) as a chainable follow-on to CVE-2026-2699.
- Progress releases ShareFile Storage Zone Controller 5.12.4, patching CVE-2026-2699 and CVE-2026-2701.
- watchTowr Labs publicly discloses the CVE-2026-2699/CVE-2026-2701 pre-auth RCE chain, including a full Python proof-of-concept exploit published to GitHub.
- Progress commits to providing ShareFile customers a further technical update within 24 hours of its initial shutdown notification, while withholding the specific vulnerability details pending investigation.
- Progress emails ShareFile customers citing a "credible external security threat" targeting Storage Zone Controllers, orders immediate manual shutdown of affected Windows servers, and temporarily disables account access; incident becomes public via a Reddit r/sysadmin post and Progress's status page marks Storage Zone Controller "not operational" at 12:12pm EDT.
- Shadowserver Foundation honeypots record the first in-the-wild exploitation attempts against the earlier, already-patched CVE-2026-2699 authentication bypass; Progress states it has not connected this activity to the ongoing shutdown.
- Progress confirms the shutdown was driven by a distinct zero-day path traversal vulnerability (arbitrary file read/write, filesystem enumeration) in Storage Zone Controller 5.x/6.x, and ships out-of-band patches 5.12.5 and 6.0.2; CVE identifier reserved, publication expected in ~2 weeks.
Sources cited for Progress ShareFile Zero-Day Path Traversal Flaw Forces
- Progress confirms ShareFile zero-day flaw behind storage zone shutdown
- URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat
- Progress urges ShareFile admins to shut down servers over "credible" threat
- New Progress ShareFile flaws can be chained in pre-auth RCE attacks
- You're Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)
- Progress ShareFile Storage Zone Controller Pre-Authentication Remote Code Execution (CVE-2026-2699, CVE-2026-2701)
- CVE-2026-2699 Detail
- Security Vulnerability Fix For ShareFile Storage Zones Controller 5.x (February 2026)
- watchTowr-vs-Progress-ShareFile-CVE-2026-2699 (PoC)
Threats related to Progress ShareFile Zero-Day Path Traversal Flaw Forces
- Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (CVE-2026-2699, CVE-2026-2701)
- SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities (CVE-2026-58231, CVSS 10.0)
- CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds Read
- CVE-2026-8037: Unauthenticated OS Command Injection in Progress Kemp LoadMaster via Uninitialized Heap in escape_quotes() (CVSS 9.6-9.8, Active Exploitation)
- CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks
- Progress ShareFile Pre-Auth RCE Chain via Authentication Bypass and Webshell Upload (CVE-2026-2699 & CVE-2026-2701)
Detection coverage for TL-2026-1317
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1317 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.