Back Gbhackers

New Progress ShareFile Flaws Expose Servers to Unauthorized Remote Takeover

Gbhackers •Divya • April 3, 2026

Security researchers at watchTowr Labs have disclosed a critical exploit chain in the Progress ShareFile Storage Zone Controller. The vulnerabilities, tracked as CVE-2026-2699 and CVE-2026-2701, enable unauthenticated attackers to achieve Remote Code Execution (RCE) and completely compromise vulnerable servers. With roughly 30,000 instances exposed to the public internet, organizations are urged to patch immediately to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Progress ShareFile Enable Unauthenticated File Exfiltration Two critical vulnerabilities, CVE-2026-2699 and CVE-2026-2701, have been identified in Progress ShareFile's Storage Zones Controller, allowing unauthenticated attackers to perform remote code execution and potentially exfiltrate files. The vulnerabilities can be chained, starting with an authentication bypass that grants access to the admin interface, followed by remote code execution through file upload functionality. Approximately 30,000 instances of Progress ShareFile are exposed on the internet, with around 700 identified by the ShadowServer Foundation. Progress has released a patch in version 5.12.4 on March 10, 2026, addressing these vulnerabilities. No active exploitation has been reported yet, but the public disclosure raises concerns about potential attacks. Organizations using affected versions are urged to apply the patch immediately to mitigate risks. 7 sources 72

Extracted Entities

New Progress ShareFile Flaws Expose Servers to Unauthorized Remote Takeover

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

MITRE ATT&CK (1)

Platforms (1)