CVE-2026-2699 in the critical feed json
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
published 2026-04-02 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-18218
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 58.4%
- EPSS 58.4% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
Patch / fix
- progress sharefile_storage_zones_controller 5.12.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
58.39% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Progress ShareFile Storage Zones Controller - Authentication Bypass nuclei detection template
- github.com https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Progress ShareFile Storage Zones Controller
Classification
References
-
github.com
/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699
exploit, third-party-advisory
-
docs.sharefile.com
/en-us/storage-zones-controller/5-0/security-vulnerability-feb26
vendor-advisory
Sources
- CVE List CVE-2026-2699
- NVD CVE-2026-2699
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.