Progress ShareFile Storage Zones Controller vulnerabilities

9 CVEs affecting Progress ShareFile Storage Zones Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93695, published 2026-10-12.

More from Progress.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-2701, published 2026-04-02. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.
• CVE-2026-2699, published 2026-04-02. Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days. Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote…
• CVE-2026-16139, published 2026-08-17. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling…
• CVE-2026-16138, published 2026-08-17. High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary…
• CVE-2026-16137, published 2026-08-17. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to…
• CVE-2026-15724, published 2026-07-21. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the…
• CVE-2026-93693, published 2026-10-12. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on…
• CVE-2026-93695, published 2026-10-12. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can…
• CVE-2026-93694, published 2026-10-12. Medium severity, CVSS 4.0. EPSS: 0.1% chance of exploitation in the next 30 days. In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition…