Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (CVE-2026-2699, CVE-2026-2701)

Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (TL-2026-1513), also tracked as WT-2026-0006, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-02. It has no confirmed attribution, affects Progress Software ShareFile Storage Zones Controller, references 2 CVEs (CVE-2026-2699, CVE-2026-2701), maps to 15 MITRE ATT&CK techniques (T1016, T1059, T1068), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1513

Threat ID
TL-2026-1513
Also known as
WT-2026-0006, WT-2026-0007, You're Not Supposed To ShareFile With Everyone
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-02
Last reviewed
2026-04-02
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
finance, health, telecoms, government administration, professionalservices, managedfiletransfer
Target regions
Global, North America, Europe, Middle East
Detection rules
9
Indicators of compromise
17

Malware and tooling in Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

Malware and tooling: Custom ASPX web shell (uploaded via CVE-2026-2701), watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py

watchTowr Labs disclosed a chained pre-authentication remote code execution attack against Progress ShareFile Storage Zone Controller (Branch 5.x, ≤5.12.3): CVE-2026-2699 is an ASP.NET 'Execution After Redirect' authentication bypass in /ConfigService/Admin.aspx, and CVE-2026-2701 abuses the resulting admin access to reconfigure the storage zone path to the webroot and upload an ASPX web shell via a ZIP-upload/unzip primitive. Fixed in 5.12.4 (2026-03-10); ~30,000 Storage Zone Controller instances are internet-facing.

How Progress ShareFile Pre-Auth RCE Chain via Auth Bypass works

Progress ShareFile Storage Zone Controller (SZC) is an on-premises Windows component that lets ShareFile customers host file storage locally while continuing to use ShareFile's cloud platform for authentication, sharing, and collaboration. watchTowr Labs found that the SZC admin interface at /ConfigService/Admin.aspx suffers from a classic ASP.NET 'Execution After Redirect' bug (CWE-698) layered on improper access control (CWE-284): the session-check code path calls a RedirectAndCompleteRequest() helper that internally invokes Response.Redirect(redirectPath, false). Per Microsoft's own documentation, passing false as the second argument to Response.Redirect tells ASP.NET NOT to terminate execution of the current request after emitting the redirect. As a result, the server sends an HTTP 302 to the login page while the full admin panel HTML for the requested page is still rendered and returned in the same response body — so an unauthenticated attacker who simply ignores the redirect (or requests the page directly and reads past the 302) receives the entire administrative UI, including internal configuration data. This is tracked as CVE-2026-2699 (CVSS 3.1 9.8 Critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

With unauthenticated admin-panel access in hand, the attacker chains into CVE-2026-2701 (CVSS 3.1 9.1 Critical). The SZC exposes a ValidateStorageLocation() routine used when defining or editing a network storage location; it validates only that the supplied path is writable/deletable (by writing and then deleting a literal 'SCTest' marker file) and performs no allow-listing or path restriction. This lets the attacker repoint the storage repository configuration at the live webroot (observed default path pattern C:\inetpub\wwwroot\ShareFile\StorageCenter\documentum). The attacker must also recover and reuse the zone's authentication secret: the /ConfigService/api/StorageZoneConfig endpoint (reachable via the same auth-bypass technique) leaks an encrypted blob (TempData2) representing the Zone Secret; this blob is decrypted using a hardcoded salt (p3510060xfZ2s9) combined with the current zone passphrase (itself readable/settable via the bypassed admin panel). The recovered Zone Secret is then used to compute an HMAC-SHA256 signature required to authorize upload requests against /StorageCenter/Upload.aspx / /upload.aspx. That endpoint accepts a ZIP archive together with an unzip=true parameter; when unzip is set, the server extracts the archive's contents in place WITHOUT re-validating or stripping executable extensions, so a ZIP containing a crafted .aspx web shell is extracted directly into the (now webroot-mapped) storage path, e.g. <network-storage-location>/files/ul-<uploadid>/1/webshell.aspx, and becomes immediately reachable and executable over HTTP — yielding full unauthenticated remote code execution as the IIS worker-process identity.

The chain requires zero credentials and zero user interaction, and functions against the default/typical SZC deployment because Storage Zone Controllers must be network-reachable both from the internet (to serve authenticated ShareFile end users) and to Progress's SaaS control plane. Both CVEs affect Storage Zone Controller Branch 5.x versions 5.12.3 and earlier; the modernized .NET Core-based Branch 6.x is not affected. Progress replicated the issues on 2026-02-18, CVEs were assigned 2026-02-26, a fix shipped as version 5.12.4 on 2026-03-10, and watchTowr publicly disclosed full technical details (with a companion Python 'Detection Artifact Generator' PoC) on 2026-04-02 after the coordinated-disclosure embargo lifted. The public PoC script only confirms the CVE-2026-2699 auth-bypass condition (GET /ConfigService/Admin.aspx; HTTP 200 = probably vulnerable, HTTP 403 = probably not vulnerable) — it deliberately does not perform the full zone-takeover/RCE chain, but the technical writeup supplies enough detail for a skilled attacker to reproduce CVE-2026-2701 independently. No confirmed in-the-wild exploitation of this specific chain has been reported as of publication, but ~30,000 SZC instances are internet-facing and file-transfer/MFT platforms (MOVEit, GoAnywhere, Accellion) have a strong recent history of being targeted by ransomware and data-extortion actors (e.g. Cl0p) immediately after pre-auth RCE disclosures, so multiple advisories flag this as a high-probability future exploitation target. Separately and unrelated to the specific CVE-2699/2701 mechanics documented here, Progress emailed ShareFile SZC customers on 2026-07-10 (roughly three months after this disclosure) urging an emergency manual shutdown of Storage Zone Controller servers over a distinct 'credible external security threat,' which the company later attributed to a newly-identified high-severity path traversal vulnerability affecting both the 5.x and 6.x branches; Progress stated it found no evidence of unauthorized account or data access. That separate incident underscores SZC's status as a recurring high-value target but is tracked outside the scope of CVE-2026-2699/CVE-2026-2701.

MITRE ATT&CK techniques used in TL-2026-1513

Discovery

T1016 System Network Configuration Discovery; T1083 File and Directory Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Credential Access

T1552.001 Credentials In Files

Impact

T1565 Data Manipulation

Resource Development

T1587.004 Exploits

Reconnaissance

T1595 Active Scanning; T1595.002 Vulnerability Scanning

Affected products and versions in Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

  • Progress Software — ShareFile Storage Zones Controller
    Vulnerable versions: 5.0.0; 5.1.x; 5.2.x; 5.3.x; 5.4.x; 5.5.x; 5.6.x; 5.7.x; 5.8.x; 5.9.x
    Fixed in: 5.12.4; 6.x (all releases)

Remediation for Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

Patches

  • Progress ShareFile Storage Zones Controller 5.12.4 (released 2026-03-10)
  • Any Storage Zones Controller 6.x release

Immediate actions

  • Upgrade Storage Zone Controller to version 5.12.4 or later immediately
  • Restrict network access to /ConfigService/Admin.aspx and other management/admin endpoints to trusted internal networks only
  • Take internet-facing Storage Zone Controllers offline until patched if immediate upgrade is not possible
  • Audit current network storage location configuration for unauthorized changes pointing to webroot or unexpected paths
  • Search web-accessible storage/upload directories for unexpected .aspx files

Workarounds

  • No official workaround beyond upgrading; Progress advisory states no mitigations are available short of patching or taking the service offline

Longer-term hardening

  • Migrate from Branch 5.x to Branch 6.x (.NET Core), which is not affected by this vulnerability class
  • Deploy WAF/reverse-proxy rules blocking direct external access to /ConfigService/* and /upload.aspx endpoints
  • Implement monitoring for anomalous access to configuration APIs and for HTTP 302 responses on Admin.aspx that also return large response bodies (>10,000 characters), which indicates the auth-bypass condition
  • Establish a recurring patch-management cadence for MFT/file-transfer edge infrastructure given its history as a ransomware entry vector

CVEs associated with Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

CVE-2026-2699, CVE-2026-2701

Weaknesses (CWE) in Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

CWE-698, CWE-284, CWE-434, CWE-306

Timeline of Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

  • watchTowr Labs privately discloses the CVE-2026-2699 authentication bypass (Execution After Redirect) to Progress Software.
  • watchTowr Labs discloses the chained CVE-2026-2701 remote code execution vulnerability, demonstrating full zone takeover and webshell upload.
  • Progress Software confirms and replicates the reported vulnerability chain internally.
  • CVE-2026-2699 and CVE-2026-2701 are formally assigned; a coordinated-disclosure embargo is set for April 2, 2026.
  • Progress releases Storage Zone Controller version 5.12.4, remediating both vulnerabilities.
  • watchTowr Labs publishes full technical writeup and a Detection Artifact Generator PoC script confirming the CVE-2026-2699 auth-bypass condition; embargo lifts.
  • RunZero, Arctic Wolf, and Beazley publish independent technical/detection analyses; RunZero publishes an asset-discovery query for exposed Storage Zone Controller instances.
  • Progress emails ShareFile Storage Zone Controller customers urging emergency manual shutdown of servers over a separate 'credible external security threat,' unrelated to the specific CVE-2026-2699/2701 mechanics.
  • Media (BleepingComputer, The Register, The Hacker News) report on Progress's emergency shutdown request; Progress states no confirmed unauthorized account or data access.
  • Progress's investigation attributes the July 2026 incident to a newly identified high-severity path traversal vulnerability affecting both the 5.x and 6.x Storage Zone Controller branches; patches issued and account access restoration begins.

Sources cited for Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

Threats related to Progress ShareFile Pre-Auth RCE Chain via Auth Bypass

Detection coverage for TL-2026-1513

As of 2026-04-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1513 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats