CVE-2026-16139: Progress ShareFile Storage Zones Controller

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

Affected products

• Progress ShareFile Storage Zones Controller: before 5.12.6 (fixed in 5.12.6); from 6.0, before 6.0.3 (fixed in 6.0.3)

Published 2026-08-17. Last modified 2026-09-02.