CVE-2026-2699

EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

State: Published
Severity: 9.8 Critical
Published: Apr 2, 2026
Updated: Apr 8, 2026
Reserved: Feb 18, 2026

Description

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-698 Execution After Redirect (EAR)
CWE-284 Improper Access Control

Affected Products

Product	Versions
ShareFile Storage Zones ControllerProgress	5.12.3 and earlierAffected

References

https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26vendor-advisory
https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.