Rescana

Critical Vulnerabilities in Progress ShareFile Prompt Urgent Shutdown

First seen 13 Jul 2026, 19:28 UTC • •68.0

Article Content

1 / 8

Browse articles

ThreatCluster •July 14, 2026 at 17:59 UTC

•Progress Software warns of critical vulnerabilities in ShareFile SZC requiring immediate shutdown.
•CVE-2026-2699 and CVE-2026-2701 allow unauthenticated access and potential remote code execution.
•No patches are available, and cloud-only ShareFile accounts are not impacted.

On July 10, 2026, Progress Software issued an urgent directive for all ShareFile customers to shut down their Storage Zone Controllers (SZC) due to critical vulnerabilities CVE-2026-2699 and CVE-2026-2701. These flaws allow unauthenticated attackers to access configuration pages and potentially execute remote code, posing severe risks to on-premises deployments of ShareFile SZC version 5.x. No patch is available, and while there is no confirmed exploitation in the wild, the vulnerabilities are considered critical. The vulnerabilities are particularly concerning due to the historical context of similar attacks on file transfer solutions. Relevant MITRE ATT&CK techniques include T1190, T1078, and T1059. Cloud-only ShareFile accounts remain unaffected by this threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 94d ago How this analysis works

Timeline

2023-07-10

CVE-2023-24489 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-04-02

CVE-2026-2699 and CVE-2026-2701 published

Progress Software disclosed two critical vulnerabilities affecting ShareFile SZC v5.x.

Rescana

2026-04-08

First public PoC for CVE-2026-2699

A proof of concept for CVE-2026-2699 was made publicly available, highlighting the vulnerability.

Rescana

2026-07-10

Urgent directive issued to shut down SZC

Progress Software advised all ShareFile customers to immediately shut down their SZC due to critical vulnerabilities.

Rescana

Recent

No confirmed exploitation reported

As of July 10, 2026, there is no confirmed exploitation of CVE-2026-2699 or CVE-2026-2701 in the wild.

Rescana

Threat Graph

12 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Zero-day Exploit
T1021 - Remote Services
T1059 - Command and Scripting Interpreter
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application

Organization (1)

Progress Software

Vulnerability (4)

CVE-2023-24489
CVE-2026-2699
CVE-2026-2701
MOVEit Zero-day

Weakness (1)

CWE-287 - Improper Authentication

Threat Actor (1)

Clop Ransomware Group

Relationships

Clop Ransomware Group uses Zero-day Exploit
Clop Ransomware Group uses T1021 - Remote Services
Clop Ransomware Group uses T1059 - Command and Scripting Interpreter
Clop Ransomware Group uses T1078 - Valid Accounts
Clop Ransomware Group uses T1190 - Exploit Public-Facing Application
Clop Ransomware Group exploits CVE-2023-24489
Clop Ransomware Group exploits CVE-2026-2699
Clop Ransomware Group exploits CVE-2026-2701
Clop Ransomware Group exploits MOVEit Zero-day
Clop Ransomware Group targets Progress Software
Clop Ransomware Group related to CWE-287 - Improper Authentication

Following this threat?

Track Clop Ransomware Group, Progress Software and CVE-2023-24489 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed