External risk intelligence

ShareFile Storage Zones Controller Configuration Bypass and Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-2699

The ShareFile Storage Zones Controller acts as an internet-facing gateway or edge service for managing file storage and data transfer, making it public-facing by design in normal deployment to facilitate remote access and file synchronization services.

Remote Code Execution

Progress Sharefile Storage Zones Controller

5.0.0 to before 5.12.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the ShareFile Storage Zones Controller, a component used for managing file storage. This issue could allow an unauthorized attacker to access sensitive configuration pages, potentially leading to changes in system settings or even the execution of malicious code remotely. The primary concern at this stage is to confirm whether this technology is in use and assess the scope of any potential exposure.

Unauthenticated access to system configuration pages.
Confirms potential for unauthorized control over file storage.
Assess exposure for impacted systems.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to sensitive configuration pages on the ShareFile Storage Zones Controller without needing any credentials. By navigating to these restricted pages, they can alter the system's settings, potentially leading to the execution of malicious code on the server.

No authentication required.
Access restricted configuration pages.
Change system configuration; potential RCE.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could access restricted configuration pages on the ShareFile Storage Zones Controller. This could allow them to change system settings and potentially execute arbitrary code, impacting the availability and integrity of the affected system.

System configuration could be altered.
Unauthenticated network access could occur.
Remote code execution may be possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ShareFile Storage Zones Controller is likely managed by infrastructure or platform teams responsible for the underlying storage and connectivity, with oversight from security teams. The first practical step is to identify all instances of the affected technology, confirm their exposure and criticality, and then assign ownership for remediation planning.

Infrastructure or platform teams own remediation.
Verify affected controller exposure and criticality.
Plan maintenance for risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Progress ShareFile Storage Zones Controller?

It is a software component that acts as a bridge for managing file storage and data transfers. Organizations use it to handle secure document synchronization and access between local storage environments and the broader ShareFile service infrastructure.

What does CVE-2026-2699 mean in simple terms?

This vulnerability involves an Improper Access Control weakness. It means the software fails to properly check if a user has permission to view administrative pages, allowing an unauthorized person to reach sensitive system settings that should be protected.

How does an attacker trigger this vulnerability?

An attacker can trigger this by sending network requests directly to specific, restricted configuration pages without providing any login credentials. Simply accessing the landing page of the controller or using authorized, authenticated workflows does not trigger the bug.

Is my system at risk if it runs this software?

If your instance is reachable from the internet, it is at higher risk. According to Halo Surface Signal, this software is often deployed as an edge gateway to enable remote access, which frequently places these controllers directly in the line of sight for network-based attacks.

What steps should I take to address this issue?

Begin by inventorying your environment to locate all instances of the affected controller. Coordinate with your infrastructure or platform teams to verify their current network placement and prioritize them for maintenance or updates as provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.