CVE-2026-2699 - NVD

nvd.nist.gov • July 16, 2026

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Progress ShareFile Prompt Urgent Shutdown On July 10, 2026, Progress Software issued an urgent directive for all ShareFile customers to shut down their Storage Zone Controllers (SZC) due to critical vulnerabilities CVE-2026-2699 and CVE-2026-2701. These flaws allow unauthenticated attackers to access configuration pages and potentially execute remote code, posing severe risks to on-premises deployments of ShareFile SZC version 5.x. No patch is available, and while there is no confirmed exploitation in the wild, the vulnerabilities are considered critical. The vulnerabilities are particularly concerning due to the historical context of similar attacks on file transfer solutions. Relevant MITRE ATT&CK techniques include T1190, T1078, and T1059. Cloud-only ShareFile accounts remain unaffected by this threat. 2 sources 68

Extracted Entities

Platforms (1)

ShareFile Storage Zones Controller