Progress ShareFile Storage Zone Controllers taken offline following security threat

July 16, 2026 Update:

On July 14, 2026, Progress Software confirmed that a previously undisclosed vulnerability was responsible for the emergency shutdown of ShareFile Storage Zone Controllers announced the previous week. The company stated that its investigation identified a high-severity path traversal vulnerability affecting all ShareFile Storage Zone Controller 5.x and 6.x releases. Progress reported that it initially took systems offline after receiving information from a credible source regarding a potential threat targeting Storage Zone Controllers.

According to Progress, an authenticated administrative user could exploit the vulnerability to read arbitrary files accessible to the application's service account, write threat actor-controlled content to arbitrary directories, or enumerate the server filesystem layout. At the time of disclosure, the company had not published a Common Vulnerabilities and Exposures (CVE) identifier but stated that one had been reserved and would be released at a later date.

Progress released ShareFile Storage Zone Controller versions 5.12.5 and 6.0.2 to address the vulnerability and stated that patched Storage Zone Controllers could be returned to service following installation of the updates.

The company also stated that, at the time of its announcement, it had identified no evidence of unauthorized access to ShareFile customer accounts or data and had not identified any active threat. Public reporting has not confirmed customer compromise or active exploitation associated with this vulnerability.

Threat summary

On July 10, 2026, Progress Software instructed customers using ShareFile Storage Zone Controllers to immediately shut down the Windows servers hosting those systems after identifying what it described as a "credible external security threat."

At the same time, the company temporarily disabled access to affected ShareFile accounts connected to Storage Zone Controllers while it investigated the issue with internal and external cybersecurity experts.

Progress stated that it had no indication of unauthorized access to ShareFile accounts or customer data at the time of notification. Later that day, at 12:12 EDT, Progress reported that the incident remained under investigation.

The notification applies to organizations running ShareFile Storage Zone Controllers, an on-premises component that allows files to remain within customer-managed infrastructure while using ShareFile cloud services for authentication, administration, sharing, and collaboration. Because these systems facilitate file transfers between customer storage and the ShareFile platform, they are commonly internet-accessible. Progress has not indicated that cloud-only ShareFile environments are affected.

As of July 10, Progress has not disclosed the nature of the threat, whether a vulnerability is involved, or whether any organizations had been compromised. No CVE identifier has been associated with the incident, and no technical indicators or threat details have been released. The directive to shut down affected servers, rather than apply a patch or configuration change, indicates that no publicly available remediation was available at the time of disclosure.

The incident follows a period of security scrutiny involving ShareFile Storage Zone Controllers. In April 2026, Progress released fixes for CVE-2026-2699 and CVE-2026-2701, two critical vulnerabilities affecting the 5.x product line. Progress has not disclosed whether the current incident is related to those vulnerabilities or to any previously reported security issue.

Analysis

ShareFile Storage Zone Controllers are internet-accessible systems that manage file transfers between customer-managed storage repositories and ShareFile cloud services. Because they sit between external users and enterprise data stores, they represent a potential pathway to sensitive organizational data if compromised.

At this time, Progress has not disclosed the nature of the threat, whether a vulnerability is involved, or whether any customer environments have been affected.

For organizations using Storage Zone Controllers, the immediate concern is maintaining the availability and security of file-sharing services while Progress continues its investigation.

Progress has already disabled access to ShareFile accounts using Storage Zone Controllers and has instructed customers to manually shut down the associated Windows servers, stating that this additional step is necessary to protect customer data.

As a result, organizations may experience disruptions to file access and related business operations until further details emerge. Security and IT teams should monitor communications from Progress for updates on the investigation, recovery procedures, indicators of compromise, and remediation guidance.

While no technical details have been released, organizations can use this period to prepare for potential remediation and investigation activities. Recommended actions include preserving system, application, and web server logs; reviewing recent administrative activity involving Storage Zone Controllers; identifying internet-exposed instances; and documenting current configurations to support future recovery efforts.

Reviewing Storage Zone Controller web directories and storage locations for unexpected files, unauthorized changes, or other anomalies may also help identify signs of suspicious activity if additional indicators become available.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up