Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.2
Progress told every on-prem ShareFile Storage Zone Controller customer to power off, then named a path-traversal flaw and shipped fixed builds
Defender actions
- Apply ShareFile Storage Zone Controller 5.12.5 or 6.0.2 to every on-prem SZC and follow Progress's account-owner recovery instructions before bringing the component back online. This is the fix for the path-traversal flaw behind the 2026-07-10 emergency shutdown, on a component that honeypots had already seen targeted by exploitation attempts against CVE-2026-2699.
- On any on-prem SZC host, run a bounded compromise check for the known chain: unexpected .aspx files under the StorageCenter webroot subdirectories (documentum/cifs/sp) and the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe.
Analysis
Progress Software has told every customer running an on-premises ShareFile Storage Zone Controller (SZC), the self-hosted IIS component that lets ShareFile's SaaS front end store files on customer-controlled storage (local filesystem, SMB, SharePoint, S3/Azure) rather than in Progress's cloud, to manually power off the Windows server hosting it, citing "a credible external security threat" first notified to customers on 2026-07-10 (BleepingComputer, 2026-07-10). Three days on, on 2026-07-13, the vendor status page still listed the Storage Zone Controller service as not operational and under investigation (Progress ShareFile status, 2026-07-13), and Progress had disclosed neither a CVE, a root cause, nor a patch or safe-restart timeline; the mitigation on offer was a full shutdown rather than an update, with no fix published as of 2026-07-13 (heise online, 2026-07-13; SecurityWeek, 2026-07-13). heise characterises the shutdown as a precautionary measure during an ongoing investigation. Progress stated it had no indication of unauthorized access to any ShareFile account or data at that point. Only on-premises SZC deployments are affected; cloud-only ShareFile tenants are not.
This sits on top of a chainable pre-auth RCE that watchTowr Labs disclosed in the same component in April 2026: CVE-2026-2699 (CVSS 9.8) is a CWE-698 execution-after-redirect authentication bypass in /ConfigService/Admin.aspx, where Response.Redirect() is called with the terminate flag set to false, so the admin page body still renders and executes after the browser is told to redirect to login; CVE-2026-2701 (CVSS 9.1) chains from that access, because the storage-location validation only checks writability, letting an attacker repoint the storage repository at the IIS web root and land an ASPX web shell (watchTowr Labs, 2026-04-02). Both were fixed in Storage Zone Controller 5.12.4 (the 6.x .NET-Core branch was unaffected); watchTowr counted roughly 30,000 internet-facing SZC instances at disclosure. Progress has not said whether the current threat relates to this chain or to a separate issue.
Defender takeaway. This is the same on-prem, internet-facing, managed-file-transfer-adjacent architecture class (ShareFile, MOVEit, GoAnywhere, Cleo) that has repeatedly produced mass pre-auth exploitation, and a vendor ordering customers to pull the plug rather than patch was, on 2026-07-13, a strong signal to treat any exposed SZC as untrusted until Progress published scope, which it did on 2026-07-14. Regardless of whether the July threat proves related to CVE-2026-2699/2701, any instance still on SZC 5.x below 5.12.4 carries a known, PoC-backed pre-auth RCE and should be upgraded or taken offline now. On 2026-07-13, with no mechanism confirmed by Progress, the CWE-698 chain was the working hunt hypothesis. Progress has since named a separate path-traversal flaw, as the updates record, so the chain remains a compounding risk on older builds rather than the explanation for the shutdown.
Triage: an authenticated administrator legitimately hits /ConfigService/Admin.aspx and receives a normal authenticated session; the anomaly for the known chain is a request to that path that returns a 302 whose response body nonetheless carries the full admin-panel HTML (the execution-after-redirect behaviour) rather than the redirect being honoured, followed by configuration changes to Zone/Primary-Zone-Controller/storage-repository fields outside a change window, and, downstream, an .aspx file appearing under a StorageCenter webroot subdirectory that is not part of the vendor's shipped file set.
Cited evidence
We have reason to believe there is a credible external security threat targeting Progress Software's ShareFile Storage Zone Controllers.
Currently, we have no indication of unauthorized access to any Progress ShareFile accounts or data.
ShareFile customers with Storage Zones Controllers are not operational at this time.
The alert arrived the same day that independent honeypots began detecting active, in-the-wild attempts to exploit a critical authentication bypass vulnerability the vendor patched earlier this year in its ShareFile Storage Zone Controller software.
Honeypots run by nonprofit cybersecurity organization Shadowserver Foundation first recorded active, in-the-wild attacks attempting to exploit CVE-2026-2699 on Friday.
This smells like CL0P ransomware group activity. If you use ShareFile, be like C-3PO and 'shut them all down.'
An authenticated administrative user can read arbitrary files accessible to the application's service account
Currently, we have no indication of unauthorized access to any ShareFile customer account or data
Storage Zones Controller customer access is currently being restored. Recovery instructions have been provided directly to account owners.
Updates3
Two developments harden the picture around Progress's emergency ShareFile Storage Zone Controller (SZC) shutdown order. First, the shutdown was not precautionary in the abstract: the alert "arrived the same day that independent honeypots began detecting active, in-the-wild attempts to exploit" the pre-auth authentication-bypass flaw CVE-2026-2699, with Shadowserver Foundation honeypots first recording those attempts on Friday 2026-07-10 (BankInfoSecurity, 2026-07-13). This moves the flaw's status from PoC-public to actively exploited. Second, defenders responded at scale, the number of internet-exposed Storage Zone Controllers fell from watchTowr's April count of about 30,000 to roughly 1,000 by 2026-07-13, evidence of widespread emergency power-downs (BankInfoSecurity, 2026-07-13). Progress restored ShareFile cloud-service access for SZC customers but continues to require the on-prem controllers themselves stay powered off pending its investigation, and still reports no evidence of unauthorized access to customer data (The Register, 2026-07-13).
Recorded Future analyst Allan Liska publicly assessed that the pattern "smells like CL0P ransomware group activity," pointing to Clop's long record of mass-exploiting secure file-transfer software (Accellion FTA, GoAnywhere, MOVEit, Cleo Harmony, and Oracle E-Business Suite) (BankInfoSecurity, 2026-07-13). This is a named researcher's hypothesis, not an attribution: Progress has identified no actor and disclosed no root cause.
Defender takeaway. The one-day earlier guidance (treat any exposed SZC as untrusted and keep it powered off rather than patched) is now backed by confirmed in-the-wild exploitation, so it should carry more weight, not less, for any organisation that has not yet acted. The recommended state remains a full power-off of on-prem Storage Zone Controllers until Progress publishes scope; the original entry's shutdown and bounded-compromise-check actions still stand unchanged.
Progress Software has confirmed the root cause behind its emergency ShareFile Storage Zone Controller (SZC) shutdown order: a high-severity path-traversal vulnerability affecting SZC versions 5.x and 6.x that lets an authenticated administrative user read arbitrary files accessible to the application's service account, write malicious content to server directories, and enumerate the filesystem layout (BleepingComputer, 2026-07-14), a CWE-22-class flaw reachable through the SZC's internet-facing IIS component. Progress has shipped patched versions 5.12.5 and 6.0.2, and a CVE identifier is reserved but will not be published for two weeks. The vendor states it has "no indication of unauthorized access to any ShareFile customer account or data," a claim that sits alongside the earlier finding that Shadowserver honeypots recorded in-the-wild exploitation attempts against the same component from 2026-07-10. Progress's status page confirms Storage Zone Controller customer access "is currently being restored," with recovery instructions issued directly to account owners (Progress, ShareFile Status Page, 2026-07-14), closing out the multi-day outage that began with the 2026-07-10 shutdown order.
The shutdown has a known cause and a fix. Progress has named the cause, a path-traversal flaw in Storage Zone Controller 5.x and 6.x reachable by an authenticated administrative user, and shipped fixed builds 5.12.5 and 6.0.2 (BleepingComputer, 2026-07-14), as the update of 2026-07-14 records. Its status page now reports that customer access "is currently being restored" (Progress ShareFile, 2026-07-14). Once the fixed builds are installed, Storage Zone Controllers can be brought back online (BleepingComputer, 2026-07-14).
Sources8
Revision history
- Published 2026-07-13T1212Z-intel
- Update 2026-07-14T1210Z-intel
Update to the 2026-07-13 ShareFile shutdown entry. Shadowserver Foundation honeypots first recorded active, in-the-wild exploitation attempts against the ShareFile Storage Zone Controller pre-auth authentication bypass CVE-2026-2699 on Friday 2026-07-10 (the same day Progress issued its emergency power-off order) and the internet-exposed instance count fell from watchTowr's April tally of ~30,000 to roughly 1,000 by 2026-07-13. A Recorded Future analyst publicly assessed possible Clop involvement; Progress has named no actor and disclosed no root cause. On-prem operators still running Storage Zone Controllers should keep them off.
Changed: cves evidence sectors sources tags body
- Update 2026-07-14T2009Z-intel
Progress has confirmed the root cause behind its emergency ShareFile Storage Zone Controller (SZC) shutdown: a high-severity path-traversal flaw in SZC 5.x/6.x that an authenticated administrative user can use to read arbitrary service-account files, write to server directories, and enumerate the filesystem. Progress shipped patched versions 5.12.5 and 6.0.2 and is restoring customer access; a CVE identifier is reserved but will not be published for two weeks. On-prem SZC operators should patch and follow Progress's recovery steps now.
Changed: actions evidence sources tags body
- Correction 2026-09-29T2134Z-audit
The title, headline and summary still described the shutdown as of day three, with no root cause and no fix. They now state what the 2026-07-14 updates established: the cause is a path-traversal flaw in Storage Zone Controller 5.x and 6.x, fixed in 5.12.5 and 6.0.2, and customer access is being restored. The status-page citation now points at the incident page, which carries the quoted update, instead of the rolling status dashboard. The action to keep servers off until Progress confirmed scope is folded into the patch-and-restore action. The sourcing note and the defender takeaway date their no-mechanism statements to first publication. An uncited claim that exposure concentrates in the US and Germany is removed from the summary and the 2026-07-14 update.
Changed: sources evidence title headline summary actions sourcing_note body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.