CVE-2026-16138: high-severity vulnerability in Progress ShareFile Storage Zones Controller
Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.8%
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Progress · ShareFile Storage Zones ControllerRelated CVEs — Progress ShareFile Storage Zones Controller
In the same product, most dangerous first.
CVE-2026-2699CRITICALEAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)EPSS 58.4%CVE-2026-2701CRITICALRCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)EPSS 54.5%CVE-2026-16139HIGHArbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code executionEPSS 0.9%CVE-2026-16137HIGHPath traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones ControllerEPSS 0.7%CVE-2026-15724HIGHPath traversal in Progress ShareFile Storage Zones Controller (SZC)EPSS 0.5%CVE-2026-93693MEDIUMUnauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones ControllerEPSS 0.2%