Progress Pulls ShareFile Storage Zone Controllers Offline, No Patch Available

Progress Software issued an emergency order on July 10 instructing every organization running an on-premises ShareFile Storage Zone Controller to immediately shut down the Windows server hosting that system — and there is no patch to apply instead. The company simultaneously cut off cloud access for all affected accounts, leaving enterprise file-sharing operations using the hybrid on-premises component offline with no timeline for restoration and no public explanation of what the threat actually is.

For any organization running a Storage Zone Controller, this is not a recommendation. Progress's language is unambiguous: "You must manually shut down the server hosting your Storage Zone Controllers. This is a critical additional step to ensure the safety of your data," Progress told customers in an emergency email on July 10.

Progress confirmed the emergency to BleepingComputer and The Hacker News , describing a "credible external security threat targeting Progress Software's ShareFile Storage Zone Controllers." The company stated it had no indication of unauthorized access to any ShareFile accounts or data at the time of disclosure and framed the disruption as a precautionary measure while it works with internal and external cybersecurity experts to investigate.

What Progress has not said: what the threat is. No CVE identifier has been assigned to the incident. No threat actor or technical indicators have been publicly named. Progress has not said whether a zero-day vulnerability is involved, whether any Storage Zone Controllers were compromised, or when customers can safely bring their systems back online. The company's status page listed Storage Zone Controller customers as "not operational" as of 12:12 p.m. ET on July 10.

The absence of a patch is the most significant detail in the company's response. When Progress has a fix available, it tells customers to apply it — the fact that the directive here is to shut down entirely, not patch and restart, signals that no publicly available remediation existed at the time of disclosure. That pattern is consistent with a vendor racing to close a newly discovered flaw, but it is also consistent with a threat a patch cannot address on its own, such as compromised credentials or a problem on Progress's own infrastructure.

ShareFile is Progress Software's enterprise file-sharing and collaboration platform. Most organizations use it as a cloud-only service. The Storage Zone Controller is an optional on-premises component — a Windows server running .NET under Microsoft's IIS web server — that allows organizations with data-residency requirements or regulatory constraints to keep files on their own infrastructure while still using ShareFile's cloud for authentication, user management, and collaboration.

The hybrid architecture solves a real compliance problem. It creates a significant security one. The controller by design must be reachable from the internet, because ShareFile's cloud directs user requests to it for file retrieval and storage. That places a .NET web application handling sensitive enterprise files directly at the network edge, accessible from outside the organization. Every organization that has deployed one to meet a data-residency requirement has, by the logic of that design, put a high-value target on the public internet, as watchTowr Labs documented in its April 2026 research.

The current shutdown order follows a separate critical vulnerability disclosure from April 2026. Security researchers at watchTowr Labs disclosed two chainable vulnerabilities in the 5.x branch of the Storage Zone Controller: CVE-2026-2699, an authentication bypass scored at CVSS 9.8, and CVE-2026-2701, a remote code execution flaw scored at CVSS 9.1.

The mechanism behind CVE-2026-2699 is a class of .NET web application flaw called an "Execution After Redirect" — the code continues running after issuing an HTTP redirect that should have terminated the request, allowing an unauthenticated attacker to reach administration pages that should have been inaccessible. CVE-2026-2701 chained onto that bypass: once inside the administration interface, an attacker could change the storage zone's file-write path to a web-accessible location, then upload a ZIP archive whose contents were automatically extracted to that location — writing a malicious ASPX webshell directly to the server's web directory. The result was unauthenticated remote code execution: a complete takeover of the server without requiring a single valid credential.

Progress patched both vulnerabilities in version 5.12.4, released on March 10, 2026 — before the public disclosure on April 2. The newer 6.x branch, rebuilt on .NET Core, was not affected by either flaw. At the time watchTowr published its findings, Shadowserver Foundation identified roughly 784 internet-exposed Storage Zone Controller instances , with the United States and Germany showing the widest exposure; watchTowr's own broader scan found approximately 30,000 instances visible on the internet.

Progress has explicitly not connected the current July 2026 incident to CVE-2026-2699 or CVE-2026-2701, and neither of the April vulnerabilities was publicly reported as exploited. The current threat remains unattributed and technically undescribed.

This is not Progress Software's first file-transfer emergency, and the Storage Zone Controller has been targeted before. In 2023, while the product still belonged to Citrix, attackers exploited CVE-2023-24489, an unauthenticated remote code execution flaw rooted in a cryptographic bug in the controller's handling of AES encryption. CISA added that vulnerability to its Known Exploited Vulnerabilities catalog and mandated remediation by September 6, 2023. Citrix's response then was the same as Progress's response now: block all unpatched controllers from connecting to the ShareFile cloud. The same access-blocking tactic, applied to the same product component, for the third time in three years.

Progress acquired ShareFile from Cloud Software Group for $875 million in October 2024 — months after MOVEit Transfer, another Progress file-transfer product, had become the centerpiece of one of the largest data-theft campaigns in recent memory. In 2023, the Clop extortion group exploited a zero-day SQL injection flaw in MOVEit Transfer, compromising more than 2,700 organizations globally before launching a mass extortion campaign. CISA estimated Clop had compromised more than 3,000 US organizations and 8,000 globally through its years-long series of managed file transfer attacks, which also targeted Accellion's File Transfer Appliance and the GoAnywhere MFT platform before MOVEit.

The pattern is structurally coherent. Managed file transfer platforms are a concentrated target: they are reachable from the internet by design, they carry sensitive data from multiple organizations, and they are trusted implicitly by the organizations and partners that rely on them. Compromising one MFT vendor or platform does not give an attacker access to one organization's files — it gives access to every organization whose data flows through that system. For financially motivated extortion groups, that economic logic makes MFT platforms worth investing significant effort to attack, including years of preparation before striking, as Kroll's analysis of Clop's MOVEit preparation documented.

Security researchers have argued for years that internet-exposed managed file transfer components represent an indefensible architecture for organizations with sensitive data. The combination of legacy codebases, pre-authentication attack surfaces, and high concentrations of regulated or confidential data makes them a persistent priority target.

The current incident raises a harder question for organizations that deployed Storage Zone Controllers specifically to satisfy data-residency requirements: whether keeping files out of a vendor's cloud is worth creating an internet-reachable server that has now been targeted with an emergency shutdown directive for the third time in three years. The compliance advantage of on-premises storage is real. So is the demonstrated targeting pattern. Organizations should use this outage window to formally evaluate whether data-residency requirements can be satisfied by cloud-native controls — encryption key management, geographic data routing, contractual data-processing terms — rather than by maintaining an internet-facing edge component that has become a documented attack pattern target.

Progress's instructions require manual action beyond what the company's own cloud-level access suspension provides. The steps are:

Shut down the Windows server hosting Storage Zone Controllers immediately — disabling cloud access alone is not sufficient per Progress's guidance.

Treat any internet-reachable controller as a potential compromise. A server that has been powered off without prior inspection cannot be assumed to be clean; a clean-looking server is not proof of a clean system, as prior ASPX webshell attacks on this product demonstrated. When Progress provides an all-clear, re-inspect before restarting.

Preserve forensic evidence now. Before any remediation or restoration, capture system logs, application logs, and web server logs from the controller. Review recent administrative activity on the Storage Zone Controller. Check web directories for unfamiliar .aspx files. Document current configurations to support recovery.

Confirm software version. Organizations on StorageCenter 5.x should confirm they are at version 5.12.4 or later, which addresses the April 2026 CVEs — though Progress has not stated that current patching status clears the July 2026 threat. Organizations on the 6.x branch were not affected by the April CVEs.

Monitor Progress's ShareFile status page and official communications. The company committed to providing updates within 24 hours of the July 10 notification.

No. Progress has confirmed that cloud-only ShareFile accounts are not affected by this incident. The shutdown directive applies exclusively to organizations running on-premises Storage Zone Controllers — the hybrid component that lets companies store files on their own infrastructure while using ShareFile's cloud for management. If your organization uses ShareFile without a Storage Zone Controller, your service should not be disrupted.

A Storage Zone Controller is a Windows server running .NET that organizations deploy on their own infrastructure when they need to keep files out of Progress's cloud — typically to satisfy data-residency regulations in healthcare, finance, or legal sectors. It sits at the network's edge, reachable from the internet. Progress's decision to order a full shutdown rather than issue a patch signals that no remediation was available when the directive went out — the standard vendor response to a patch-available threat is "apply this update," not "power it off." Whether the underlying issue is a new zero-day, a problem on Progress's own infrastructure, or something else has not been disclosed.

In April 2026, watchTowr Labs disclosed two chainable vulnerabilities in the 5.x branch of the Storage Zone Controller — CVE-2026-2699, an authentication bypass that let unauthenticated attackers reach administrative pages, and CVE-2026-2701, which combined with the first to allow full remote code execution without credentials. Progress patched both in version 5.12.4 in March 2026. The July 2026 incident is separate: Progress has not connected the current threat to those CVEs, and neither April vulnerability was reported as exploited before the July emergency. Administrators at version 5.12.4 or higher should still follow the shutdown directive — the current patch status does not mean the current threat is addressed.

This is the third emergency affecting the Storage Zone Controller component specifically in three years, following the 2023 CVE-2023-24489 exploitation and the April 2026 critical CVE disclosure. The component exists specifically to let organizations keep files out of the cloud — but it does so by placing a .NET web server reachable from the internet directly inside the network edge. Security researchers have documented that internet-facing managed file transfer components are a priority target for financially motivated extortion groups, in part because a single compromised platform can yield sensitive data from multiple organizations simultaneously. Organizations using on-premises storage for compliance reasons should evaluate whether cloud-native alternatives — encryption key management held by the customer, contractual data-routing controls, geographic data-residency enforcement at the SaaS layer — can meet the same regulatory requirements without the documented exposure.