CVE-2026-2699criticalobserved exploitationCWE-284CWE-698

CVE-2026-2699: critical vulnerability in Progress ShareFile Storage Zones Controller

EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

Published · Updated

Follow this CVE+ Monitor ShareFile Storage Zones Controller

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 58%
from disclosure to weapon
Published on NVDApr 2
VulnCheck+99d
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Progress · ShareFile Storage Zones Controller
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Progress ShareFile Storage Zones Controller

In the same product, most dangerous first.

CVE-2026-2701CRITICALRCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)EPSS 54.5%CVE-2026-16139HIGHArbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code executionEPSS 0.9%CVE-2026-16138HIGHRemote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO serviceEPSS 0.8%CVE-2026-16137HIGHPath traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones ControllerEPSS 0.7%CVE-2026-15724HIGHPath traversal in Progress ShareFile Storage Zones Controller (SZC)EPSS 0.5%CVE-2026-93693MEDIUMUnauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones ControllerEPSS 0.2%