Back Cisecurity

Multiple Vulnerabilities in Progress ShareFile Could Allow for Remote Code Execution

Cisecurity • April 2, 2026

Multiple vulnerabilities have been discovered in Progress ShareFile, which when chained together, could allow for remote code execution. Progress ShareFile is a secure, cloud-based content collaboration and file-sharing platform. It enables businesses to securely exchange documents, manage client workflows, and obtain electronic signatures, with a focus on compliance for industries like finance and healthcare. Successful exploitation of the vulnerabilities when chained together could allow attackers to abuse the file upload and extraction functionality to place malicious ASPX webshells in the application’s webroot.

watchTowr released PoC code and a demo publicly for CVE-2026-2699 and CVE-2026-2701

Multiple vulnerabilities have been discovered in Progress ShareFile, which when chained together, could allow for remote code execution. Details of the vulnerabilities are as follows:

Tactic : Initial Access ( TA0001 ):

Technique : Exploit Public-Facing Application ( T1190 ):

Successful exploitation of the vulnerabilities when chained together could allow attackers to abuse the file upload and extraction functionality to place malicious ASPX webshells in the application’s webroot.

We recommend the following actions be taken:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Progress ShareFile Enable Unauthenticated File Exfiltration Two critical vulnerabilities, CVE-2026-2699 and CVE-2026-2701, have been identified in Progress ShareFile's Storage Zones Controller, allowing unauthenticated attackers to perform remote code execution and potentially exfiltrate files. The vulnerabilities can be chained, starting with an authentication bypass that grants access to the admin interface, followed by remote code execution through file upload functionality. Approximately 30,000 instances of Progress ShareFile are exposed on the internet, with around 700 identified by the ShadowServer Foundation. Progress has released a patch in version 5.12.4 on March 10, 2026, addressing these vulnerabilities. No active exploitation has been reported yet, but the public disclosure raises concerns about potential attacks. Organizations using affected versions are urged to apply the patch immediately to mitigate risks. 7 sources 72

Extracted Entities

Multiple Vulnerabilities in Progress ShareFile Could Allow for Remote Code Execution

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Industries (1)

MITRE ATT&CK (2)