Progress ShareFile Storage Zone Controller pre-auth access via Execution After Redirect
Critical (CVSS 9.8) authentication bypass in Progress ShareFile Storage Zone Controller 5.12.3 and earlier. The 5.x web tier redirects unauthenticated users but keeps executing the page, letting attackers reach admin functionality without credentials. Fixed in 5.12.4 on March 10, 2026.
- Vendor
- Progress Software
- Product
- ShareFile Storage Zone Controller (5.x branch)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-2699 is a critical, unauthenticated access flaw in Progress ShareFile Storage Zone Controller — the on-prem component customers deploy in their own datacenter or cloud tenancy to hold the actual file bytes for a ShareFile managed file-transfer environment. The bug is a textbook Execution After Redirect (CWE-698): the application issues an HTTP redirect for an unauthenticated request but does not terminate handler execution, so the “restricted” admin surface still runs and returns to the caller.
NVD’s canonical entry describes it plainly: “an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.” The CVSS 9.8 score reflects the pre-auth network reachability plus the impact of reaching admin config, not a self-contained RCE — the RCE half of the chain lives in CVE-2026-2701, which is separately authenticated but reachable through this bypass.
Affected and fixed versions
- Affected: Storage Zone Controller 5.x branch, 5.12.3 and earlier
- Fixed: 5.12.4 (released to customers on the 5.x branch March 10, 2026)
Discovery credit goes to watchTowr Labs (WT-2026-0006), which reported to Progress on February 6, 2026 and coordinated disclosure through the April 2, 2026 embargo lift.
What to do
If you run on-prem ShareFile Storage Zone Controllers:
- Confirm the build number. Anything on the 5.x branch below 5.12.4 is vulnerable.
- Apply 5.12.4 via the Progress support portal. Patch is four months old at this point — if you’re behind, you’re behind for a reason worth documenting.
- Review admin activity on the Storage Zone Controller since March 2026. Unexplained config changes, unfamiliar admin logins, or a service-account footprint on paths it has no business touching are all in scope.
- If you are on the 6.x branch, this specific CVE does not apply, but do not use that as an excuse to skip the July 2026 5.12.5 / 6.0.2 patch — that’s a separate flaw.
Not currently on the CISA Known Exploited Vulnerabilities catalog. That is not evidence of safety on a product Progress has had to shut down twice in eighteen months.
