# Progress ShareFile Zero-Day Path Traversal Flaw Forces Storage Zone Controller Shutdown

> Progress Software confirmed a zero-day path traversal vulnerability in ShareFile Storage Zone Controller (versions 5.x and 6.x) that lets an authenticated administrative user read arbitrary files, write attacker-controlled content to arbitrary directories, or enumerate server filesystem layout. The vendor took storage zones offline as a precaution and shipped out-of-band fixes in versions 5.12.5 and 6.0.2.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1317
- **ID:** TL-2026-1317
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-10, Progress Software emailed ShareFile customers warning of a "credible external security threat" targeting Storage Zone Controllers (SZC) — customer-managed Windows servers that provide on-premises file storage while relying on ShareFile's cloud-based authentication, permissions, auditing, and collaboration layer. Progress ordered an immediate manual shutdown of affected Windows servers and temporarily disabled access to ShareFile accounts using Storage Zone Controllers, without initially disclosing the technical nature of the threat. The incident became public after a customer posted Progress's notification email to Reddit's r/sysadmin; Progress's status page listed Storage Zone Controller as "not operational" from 12:12pm EDT that day.

On 2026-07-14, Progress confirmed the root cause: a zero-day path traversal vulnerability in the SZC codebase (versions 5.x and 6.x) that allows an authenticated administrative user to (1) read arbitrary files accessible to the application's IIS service account, (2) write threat-actor-controlled content to arbitrary directories on the host filesystem, and (3) enumerate the full server filesystem layout. Progress shipped out-of-band patches in versions 5.12.5 and 6.0.2, and states it has no evidence of unauthorized customer access or active exploitation of this specific flaw. A CVE identifier has been reserved but is not expected to publish for roughly two weeks.

This disclosure lands squarely in the shadow of a separate, already-public pre-authentication RCE chain in the same product line: CVE-2026-2699 (CVSS 9.8, authentication bypass via Execution-After-Redirect in `/ConfigService/Admin.aspx`) and CVE-2026-2701 (CVSS 9.1, arbitrary file upload leading to ASPX webshell RCE), disclosed by watchTowr Labs on 2026-04-02 after a responsible-disclosure window, and patched in 5.12.4 (2026-03-10). Shadowserver Foundation's honeypots recorded the first in-the-wild exploitation attempts against CVE-2026-2699 on 2026-07-11 — one day after Progress's shutdown order and three days before the new zero-day was confirmed. Progress has explicitly stated it has NOT connected the July shutdown/zero-day to CVE-2026-2699/CVE-2026-2701, and neither of those CVEs has been added to the CISA KEV catalog as of this writing, but the close timing, shared component (Storage Zone Controller), and shared threat class (path/file-handling abuse of the customer-managed on-prem SZC tier) warrant continued correlation. ShareFile Storage Zone Controllers are typically internet-reachable at the network edge (they broker file transfers between the ShareFile cloud platform and customer-managed storage), with watchTowr estimating ~30,000 internet-facing instances and Shadowserver counting 700-784 confirmed exposed hosts concentrated in the US and Europe/Germany.

The incident draws direct comparisons in press coverage to the 2023 Clop ransomware group's mass exploitation of a zero-day in Progress MOVEit Transfer (CVE-2023-34362), another Progress-owned managed-file-transfer product with a history of severe, actively-exploited vulnerabilities. Progress committed to providing customers an update within 24 hours of its initial 2026-07-10 notification and continues to recommend keeping controllers offline pending full guidance, verifying patch currency, and — for internet-reachable instances — treating the event as a potential incident: preserving logs and auditing webroots for unfamiliar `.aspx` files.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1505.003 Web Shell
- T1211 Exploitation for Stealth
- T1140 Deobfuscate/Decode Files or Information
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1595.001 Scanning IP Blocks
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery

## Sources

- [Progress confirms ShareFile zero-day flaw behind storage zone shutdown](https://www.bleepingcomputer.com/news/security/progress-confirms-sharefile-zero-day-flaw-behind-storage-zone-shutdown/)
- [URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat](https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html)
- [Progress urges ShareFile admins to shut down servers over "credible" threat](https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/)
- [New Progress ShareFile flaws can be chained in pre-auth RCE attacks](https://www.bleepingcomputer.com/news/security/new-progress-sharefile-flaws-can-be-chained-in-pre-auth-rce-attacks/)
- [You're Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)](https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/)
- [Progress ShareFile Storage Zone Controller Pre-Authentication Remote Code Execution (CVE-2026-2699, CVE-2026-2701)](https://watchtowr.com/resources/progress-sharefile-storage-zone-controller-pre-auth-rce-cve-2026-2699-cve-2026-2701/)
- [CVE-2026-2699 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-2699)
- [Security Vulnerability Fix For ShareFile Storage Zones Controller 5.x (February 2026)](https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26.html)
- [watchTowr-vs-Progress-ShareFile-CVE-2026-2699 (PoC)](https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1317