Summary
Security researchers are sounding the alarm on two critical vulnerabilities in Progress Software’s ShareFile Storage Zones Controller, tracked as CVE-2026-2699 and CVE-2026-2701. When chained together, these flaws allow an unauthenticated attacker to achieve remote code execution on vulnerable servers — no credentials required.
ShareFile is a widely-used enterprise file sharing and collaboration platform, particularly popular in regulated industries like finance, healthcare, and legal. The Storage Zones Controller handles on-premises data storage, making it a critical component of many organizations’ data infrastructure.
Progress Software has released patches and is urging immediate updates. No active exploitation has been confirmed yet, but researchers warn that weaponized exploits could appear quickly given the severity and the detailed advisory published alongside the disclosure.
Sources
- Cybersecurity Dive – Researchers warn of critical Progress ShareFile flaws
- Cryptika – New Progress ShareFile bugs let attackers take over servers
Commentary
Progress Software can’t seem to catch a break. After the catastrophic MOVEit breach in 2023 that affected thousands of organizations, another critical RCE in a file transfer product is going to raise serious questions about their security development lifecycle. Unauthenticated RCE is about as bad as it gets on the severity scale.
The saving grace is that exploitation hasn’t been observed in the wild yet — but that clock is ticking. Organizations running ShareFile Storage Zones on-premises should treat this as a drop-everything patch. The combination of the target-rich environment (sensitive business files) and the ease of exploitation (no auth needed) makes this an extremely attractive target for ransomware operators and data extortion groups.