CVE-2026-93694: Progress ShareFile Storage Zones Controller

Medium severity, CVSS 4.0. EPSS: 0.1% chance of exploitation in the next 30 days.

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

Affected products

• Progress ShareFile Storage Zones Controller: up to and including 5.12.6

Published 2026-10-12. Last modified 2026-10-15.