Progress Patches ShareFile Zero-Day in Its Third Crisis Since 2023

Progress Software restored access to ShareFile’s Storage Zone Controllers on July 14, four days after ordering customers to shut the servers down over a credible external threat. The company says the cause was a high-severity path traversal flaw in Storage Zone Controller versions 5.x and 6.x. Security researchers had spent the week speculating about an unauthenticated remote-code hole. Progress’s account describes something narrower: a zero-day flaw that requires a valid administrative login.

This is the third time in three years a Progress-linked file-transfer product has forced customers into an emergency shutdown. The response, cutting cloud access and ordering physical servers powered off, is nearly identical to the one used on the same product back in 2023, when Citrix still owned it.

Progress Confirms the Flaw Behind the ShareFile Shutdown

Progress Software’s email to ShareFile customers on the evening of July 10 didn’t hedge. “IMMEDIATE ACTION REQUIRED: You must manually shut down the server hosting your Storage Zone Controllers,” it read. A system administrator shared it hours later in a public sysadmin forum post carrying the full notice, and IT teams outside Progress’s own customer list got their first look at the wording.

Storage Zone Controllers are the on-premises half of ShareFile’s hybrid setup. Companies keep their files on their own servers while ShareFile’s cloud handles login, permissions and collaboration tools. The controller sits between the two, processing every upload and download, which is why it typically lives at the edge of a company’s network with a foot in the open internet.

That exposure is the whole point of the product. It’s also what makes it a target.

Progress spent days saying almost nothing about what it was defending against. That changed this week. In an update sent to customers, the company said its investigation had identified a high-severity path traversal vulnerability affecting all 5.x and 6.x versions of the Storage Zone Controller.

An authenticated administrative user can read arbitrary files accessible to the application’s service account, write threat actor-controlled content to arbitrary directories or enumerate the server filesystem layout.

That description comes from an email Progress sent customers, reviewed by BleepingComputer, a cybersecurity news outlet. Progress said a CVE identifier has been reserved for the zero-day flaw and will be published within about two weeks. The company shipped fixes alongside the disclosure: Storage Zone Controller versions 5.12.5 and 6.0.2, with instructions to install them immediately.

Four Days From Shutdown to Patch

The sequence, pieced together from Progress’s own notices and outside reporting, moved fast for an enterprise vendor:

1. July 10: Progress emails ShareFile customers after business hours, ordering an immediate, manual shutdown of the Windows servers hosting Storage Zone Controllers and citing a credible external security threat. A system administrator posts the notice publicly within hours.
2. July 11: ShareFile’s status page logs the disruption at 12:12 p.m. EDT, listing Storage Zone Controller customers as not operational while an investigation gets underway. Cloud-only ShareFile accounts stay unaffected throughout.
3. July 14: Progress confirms the cause, a high-severity path traversal flaw in Storage Zone Controller versions 5.x and 6.x. Access is restored, patched versions 5.12.5 and 6.0.2 ship, and a CVE identifier is reserved.
4. Late July (expected): The reserved CVE identifier is due for public disclosure, roughly two weeks after Progress’s July 14 confirmation.

Four calendar days separated a shutdown order that named no vulnerability from a working fix and a technical explanation. Progress confirmed the restoration directly. “As of Tuesday, July 14th, access has been restored for Progress ShareFile Storage Zones Controller customers following the service disruption we communicated previously,” the company told SecurityWeek, a cybersecurity publication.

The Pre-Auth Theory That Didn’t Hold Up

Before Progress said anything, the security community filled the silence with theories. Some researchers pointed to two recently disclosed identifiers, CVE-2026-2699 and CVE-2026-2701, and suggested attackers had chained them into a pre-authentication remote-code-execution path, the kind of bug that needs no valid login and spreads fastest.

That theory doesn’t match what Progress ultimately described. The confirmed vulnerability sits behind authentication: an attacker needs a valid administrative account before they can read files, plant content, or map the server’s directory structure. That’s still a real problem for any organization whose admin credentials have leaked or been phished.

Progress hasn’t said whether CVE-2026-2699 and CVE-2026-2701 have anything to do with the flaw it ultimately fixed. Its own advisory describes one path traversal issue, not a chained pair. That gap between the early theory and the vendor’s account remains open.

The confirmed picture, and the gaps still in it:

What we know:

• Confirmed cause: a high-severity path traversal flaw in Storage Zone Controller versions 5.x and 6.x.
• Access required: exploitation needs an authenticated administrative account, not an open door on the internet.
• Fix available: versions 5.12.5 and 6.0.2, released alongside the July 14 confirmation.
• No confirmed breach: Progress’s original notice said it had no indication of unauthorized access to any ShareFile accounts or data.

What’s unconfirmed:

• The CVE number: reserved but not yet public, expected within about two weeks of the July 14 update.
• Who is behind it: Progress has not named or characterized the actor behind the credible external threat.
• Whether any controller was actually breached: before or after the July 10 shutdown order.
• The CVE-2026-2699/2701 link: whether the community’s early chained-exploit theory maps onto the flaw Progress fixed at all.

The Same Playbook Progress Used in 2023

A Storage Zone Controller forced a shutdown once before. In 2023, while the product still belonged to Citrix, attackers exploited an unauthenticated remote-code-execution flaw tracked as CVE-2023-24489. SentinelOne’s vulnerability database describes the bug as one that let unauthenticated attackers remotely compromise affected systems with no login required.

The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its known-exploited vulnerabilities list that August. Qualys clocked its severity at 9.1 out of 10 once the listing went live.

Citrix’s fix for that flaw was the same move Progress just made: cut unpatched controllers off from the ShareFile cloud until customers updated. Progress acquired ShareFile in 2024, inheriting the product, its architecture, and its emergency playbook too.

A Third Strike for Progress’s File-Transfer Lineage

Zoom out and a pattern appears. Progress Software’s file-transfer lineage, ShareFile and the separate MOVEit platform, has produced three major security emergencies in three years.

The middle row comes from a case study on the MOVEit breach, a separate Progress product that attackers hit the same year Citrix was patching Storage Zone Controllers. Different exploit, same corporate parent, same year.

What Should Storage Zone Controller Admins Do Now?

Administrators running Storage Zone Controller should confirm they’re on version 5.12.5 or 6.0.2 before reconnecting to ShareFile’s cloud, check controller logs back to July 10 for unusual file activity, and treat the still-unpublished CVE as a reason to keep patching cadence tight once it goes live.

• Confirm the Storage Zone Controller is running version 5.12.5 on the 5.x line or 6.0.2 on the 6.x line before bringing it back online.
• Don’t treat the earlier 5.12.4 baseline as sufficient. It closes older flaws, not the one Progress disclosed on July 14.
• Pull Storage Zone Controller logs from July 10 onward and check for file reads, writes, or directory enumeration outside normal admin activity.
• Limit internet exposure of the controller’s management interface where possible. Only the file-transfer function needs to face outward.
• Watch for the reserved CVE identifier’s publication, expected within about two weeks, and run it against internal vulnerability scanners once it lands.

Speed matters once a flaw goes public. A Docker authentication bypass in the Gitea platform was under active exploitation just 13 days after its patch shipped, a reminder that the gap between disclosure and attack keeps shrinking industry-wide. The CVE that would explain exactly what was exploited here is still roughly two weeks from daylight.

Frequently Asked Questions

Is MOVEit the Same Product as ShareFile?

No. MOVEit Transfer and ShareFile are separate file-transfer products, both owned by Progress Software. MOVEit’s 2023 breach, which exposed data on roughly 93.3 million people across more than 2,700 organizations, is unrelated to the Storage Zone Controller flaw disclosed in July 2026, though both incidents sit under the same corporate parent.

Do Storage Zone Controllers Restart on Their Own Now That Access Is Restored?

No. Progress’s July 14 update restored cloud-side access to ShareFile accounts, but the physical Windows servers hosting Storage Zone Controllers were shut down manually by customers on July 10 and don’t power back on by themselves. Administrators need to apply the 5.12.5 or 6.0.2 patch before bringing their own servers back online.

Should Companies Move Away From On-Premises Storage Zone Controllers?

Progress hasn’t told customers to abandon the hybrid model, and cloud-only ShareFile accounts were never affected by this incident. But the on-premises controller has now been the entry point for two confirmed critical vulnerabilities in three years, a record that security teams weighing hybrid versus cloud-only deployments will have to factor in.