# Progress ShareFile Pre-Auth RCE Chain via Auth Bypass (CVE-2026-2699, CVE-2026-2701)

> watchTowr Labs disclosed a chained pre-authentication remote code execution attack against Progress ShareFile Storage Zone Controller (Branch 5.x, ≤5.12.3): CVE-2026-2699 is an ASP.NET 'Execution After Redirect' authentication bypass in /ConfigService/Admin.aspx, and CVE-2026-2701 abuses the resulting admin access to reconfigure the storage zone path to the webroot and upload an ASPX web shell via a ZIP-upload/unzip primitive. Fixed in 5.12.4 (2026-03-10); ~30,000 Storage Zone Controller instances are internet-facing.

- **Published:** 2026-04-02T00:00:00Z
- **Last reviewed:** 2026-04-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1513
- **ID:** TL-2026-1513
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-2699, CVE-2026-2701

## Description

Progress ShareFile Storage Zone Controller (SZC) is an on-premises Windows component that lets ShareFile customers host file storage locally while continuing to use ShareFile's cloud platform for authentication, sharing, and collaboration. watchTowr Labs found that the SZC admin interface at /ConfigService/Admin.aspx suffers from a classic ASP.NET 'Execution After Redirect' bug (CWE-698) layered on improper access control (CWE-284): the session-check code path calls a RedirectAndCompleteRequest() helper that internally invokes Response.Redirect(redirectPath, false). Per Microsoft's own documentation, passing false as the second argument to Response.Redirect tells ASP.NET NOT to terminate execution of the current request after emitting the redirect. As a result, the server sends an HTTP 302 to the login page while the full admin panel HTML for the requested page is still rendered and returned in the same response body — so an unauthenticated attacker who simply ignores the redirect (or requests the page directly and reads past the 302) receives the entire administrative UI, including internal configuration data. This is tracked as CVE-2026-2699 (CVSS 3.1 9.8 Critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

With unauthenticated admin-panel access in hand, the attacker chains into CVE-2026-2701 (CVSS 3.1 9.1 Critical). The SZC exposes a ValidateStorageLocation() routine used when defining or editing a network storage location; it validates only that the supplied path is writable/deletable (by writing and then deleting a literal 'SCTest' marker file) and performs no allow-listing or path restriction. This lets the attacker repoint the storage repository configuration at the live webroot (observed default path pattern C:\inetpub\wwwroot\ShareFile\StorageCenter\documentum). The attacker must also recover and reuse the zone's authentication secret: the /ConfigService/api/StorageZoneConfig endpoint (reachable via the same auth-bypass technique) leaks an encrypted blob (TempData2) representing the Zone Secret; this blob is decrypted using a hardcoded salt (p3510060xfZ2s9) combined with the current zone passphrase (itself readable/settable via the bypassed admin panel). The recovered Zone Secret is then used to compute an HMAC-SHA256 signature required to authorize upload requests against /StorageCenter/Upload.aspx / /upload.aspx. That endpoint accepts a ZIP archive together with an unzip=true parameter; when unzip is set, the server extracts the archive's contents in place WITHOUT re-validating or stripping executable extensions, so a ZIP containing a crafted .aspx web shell is extracted directly into the (now webroot-mapped) storage path, e.g. <network-storage-location>/files/ul-<uploadid>/1/webshell.aspx, and becomes immediately reachable and executable over HTTP — yielding full unauthenticated remote code execution as the IIS worker-process identity.

The chain requires zero credentials and zero user interaction, and functions against the default/typical SZC deployment because Storage Zone Controllers must be network-reachable both from the internet (to serve authenticated ShareFile end users) and to Progress's SaaS control plane. Both CVEs affect Storage Zone Controller Branch 5.x versions 5.12.3 and earlier; the modernized .NET Core-based Branch 6.x is not affected. Progress replicated the issues on 2026-02-18, CVEs were assigned 2026-02-26, a fix shipped as version 5.12.4 on 2026-03-10, and watchTowr publicly disclosed full technical details (with a companion Python 'Detection Artifact Generator' PoC) on 2026-04-02 after the coordinated-disclosure embargo lifted. The public PoC script only confirms the CVE-2026-2699 auth-bypass condition (GET /ConfigService/Admin.aspx; HTTP 200 = probably vulnerable, HTTP 403 = probably not vulnerable) — it deliberately does not perform the full zone-takeover/RCE chain, but the technical writeup supplies enough detail for a skilled attacker to reproduce CVE-2026-2701 independently. No confirmed in-the-wild exploitation of this specific chain has been reported as of publication, but ~30,000 SZC instances are internet-facing and file-transfer/MFT platforms (MOVEit, GoAnywhere, Accellion) have a strong recent history of being targeted by ransomware and data-extortion actors (e.g. Cl0p) immediately after pre-auth RCE disclosures, so multiple advisories flag this as a high-probability future exploitation target. Separately and unrelated to the specific CVE-2699/2701 mechanics documented here, Progress emailed ShareFile SZC customers on 2026-07-10 (roughly three months after this disclosure) urging an emergency manual shutdown of Storage Zone Controller servers over a distinct 'credible external security threat,' which the company later attributed to a newly-identified high-severity path traversal vulnerability affecting both the 5.x and 6.x branches; Progress stated it found no evidence of unauthorized account or data access. That separate incident underscores SZC's status as a recurring high-value target but is tracked outside the scope of CVE-2026-2699/CVE-2026-2701.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1140 Deobfuscate/Decode Files or Information
- T1552.001 Credentials In Files
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1071.001 Web Protocols
- T1565 Data Manipulation

## Sources

- [You're Not Supposed To ShareFile With Everyone: Progress ShareFile Pre-Auth RCE Chain (CVE-2026-2699, CVE-2026-2701)](https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/)
- [Progress ShareFile Storage Zone Controller Pre-Authentication Remote Code Execution (CVE-2026-2699, CVE-2026-2701)](https://watchtowr.com/resources/progress-sharefile-storage-zone-controller-pre-auth-rce-cve-2026-2699-cve-2026-2701/)
- [Security Vulnerability Fix For ShareFile Storage Zones Controller 5.x (February 2026)](https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26.html)
- [CVE-2026-2699 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-2699)
- [watchTowr-vs-Progress-ShareFile-CVE-2026-2699 (Detection Artifact Generator PoC)](https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699)
- [Progress ShareFile RCE vulnerabilities: Find impacted assets](https://www.runzero.com/blog/progress-sharefile/)
- [CVE-2026-2699-and-CVE-2026-2701 | Arctic Wolf](https://arcticwolf.com/resources/blog/cve-2026-2699-cve-2026-2701/)
- [Critical Service Disruption Analysis: Zero-Day Vulnerabilities (CVE-2026-2699 & CVE-2026-2701) Impacting Progress ShareFile Storage Zones Controller v5.x](https://www.rescana.com/post/critical-service-disruption-analysis-zero-day-vulnerabilities-cve-2026-2699-cve-2026-2701-impacting-progress-sharefile-s)
- [Critical Vulnerabilities in Progress ShareFile (CVE-2026-2699, CVE-2026-2701)](https://beazley.security/alerts-advisories/critical-vulnerabilities-in-progress-sharefile-cve-2026-2699-cve-2026-2701)
- [ShareFile Pre-Auth RCE: CVE-2026-2699 & 2701](https://fyntralink.com/en/blog/progress-sharefile-pre-auth-rce-cve-2026-2699-2701-saudi-financial-sector/)
- [Progress Urges ShareFile Admins to Shut Down Servers Over Credible Security Threat](https://cybersecuritynews.com/progress-sharefile-admins-shut-down-servers/)
- [Progress urges ShareFile admins to shut down servers over "credible" threat](https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1513