All Articles

On July 10, Progress Software emailed ShareFile customers running Storage Zone Controllers and asked them to do something vendors almost never ask: power off the Windows servers hosting the product. Four days later the company confirmed why. Its investigation found a high severity path traversal vulnerability affecting every 5.x and 6.x build of the controller, and patched versions are now shipping.

What happened: a four day timeline

The sequence matters here, because your incident response scope depends on which window your controllers were exposed in.

The vulnerability: what path traversal buys an attacker here

Per the notification Progress sent customers, an authenticated administrative user can abuse the flaw to do three things on the SZC host:

• Read arbitrary files accessible to the application's service account, which on a file transfer server includes the files customers store there.
• Write attacker-controlled content to arbitrary directories. On an IIS-backed Windows product, writing content into a web-served path is a classic route from file write to webshell to code execution.
• Enumerate the server filesystem layout, which supports both of the above.

Storage Zone Controllers exist so an organization can keep file contents on its own storage while ShareFile's cloud handles authentication, permissions, auditing, and sharing. That design places the controller at the network edge, reachable from the internet, holding exactly the data extortion crews monetize. This is the same architectural position that made MOVEit Transfer and GoAnywhere such productive targets.

The part that does not add up yet

One observation worth sitting with: the confirmed flaw requires an authenticated administrative user, yet Progress ordered a full power-off rather than an access restriction, and it acted on external threat intelligence rather than an internal find. A vendor does not usually take its own product offline globally to mitigate a bug that only its customers' admins can trigger. That gap suggests either concern that admin credentials were already in attacker hands, or that the reported threat described more than what has been confirmed so far. Progress has not said which, and BleepingComputer reports the company has not yet explained why CVE publication is delayed two weeks.

Separately, commenters on the r/sysadmin thread speculated that attackers could chain CVE-2026-2699 and CVE-2026-2701, two SZC flaws patched earlier this year, into pre-auth remote code execution. That chain is unconfirmed and Progress has not connected the current threat to those CVEs. Treat it as community speculation until the CVE record publishes.

Why this rhymes: ShareFile and the MFT attack pattern

This product line has been through this cycle before. In 2023, while ShareFile belonged to Citrix, an unauthenticated flaw in the same Storage Zones Controller (CVE-2023-24489) was exploited in the wild and landed in CISA's KEV catalog. Progress itself absorbed the MOVEit campaign in 2023, where a zero day exploited by Clop reached more than 2,700 organizations. Managed file transfer servers remain one of the most reliable single-box paydays in the extortion economy: one internet-facing host, all the sensitive files, minimal lateral movement required.

If your third party risk process treats MFT products as ordinary business software, this is the recurring evidence that they belong in the same exposure tier as VPN concentrators and edge firewalls. We covered the discipline of watching that tier continuously in our fireside on managing a dynamic attack surface.

What security teams should do now

1. Patch before restart. Upgrade Storage Zone Controllers to 5.12.5 (5.x line) or 6.0.2 (6.x line) before reconnecting them. Progress says controllers can return online once updated.
2. Audit SZC administrative accounts. The confirmed flaw is admin-authenticated. Enumerate who holds admin on each controller, reset those credentials, and check identity provider logs for anomalous logins to those accounts since early July.
3. Sweep the web directories. Review SZC hosts for unfamiliar .aspx files in IIS-served paths and content in directories the application should not write to. File write plus web path equals webshell until proven otherwise.
4. Pull and preserve logs now. IIS logs, Windows event logs, and ShareFile application logs from the SZC host, covering at least the period since the July 10 notice. If the CVE record lands in two weeks with exploitation details, you will want this window preserved.
5. Check egress. Look for large or unusual outbound transfers from SZC hosts to unfamiliar destinations. Data theft from MFT servers typically shows up as a short, high-volume egress burst.
6. Treat internet-exposed controllers as suspect. If a controller was reachable from the internet and unpatched during the exposure window, run it through your incident response process rather than assuming the shutdown protected it. Admin credential hygiene incidents have a way of surfacing later, as CISA's own GitHub credential leak postmortem showed.
7. Validate, do not assume. Confirm from outside your perimeter that no forgotten SZC instance is still reachable. Shadow deployments of file transfer software are common in acquisitions and regional offices.

If you do one thing today: inventory every ShareFile Storage Zone Controller you own, confirm each is offline or upgraded to 5.12.5 / 6.0.2, and reset every administrative credential on them.

Immediate action checklist

• Inventory all SZC instances, including subsidiaries and acquired environments
• Upgrade to 5.12.5 or 6.0.2 before restart
• Reset SZC admin credentials, review admin login history since July 1
• Hunt for unexpected .aspx files and writes outside expected directories
• Preserve IIS, Windows event, and application logs
• Review egress from SZC hosts for bulk transfers
• Watch for the CVE publication in late July and re-run detections against any released IOCs

Community note: the recurring lesson from MFT incidents is that the exposed instance you get breached through is often the one missing from your asset list. FireCompass Free Explorer runs a free self-serve AI pen test against your external attack surface, no asset list and no credit card required, which is a quick way to verify no forgotten ShareFile or other file transfer endpoint is still internet-facing: firecompass.com/start-free-explorer.

Related on CISOPlatform

• CISO FireSide Chat: A CISO's Guide On How To Manage A Dynamic Attack Surface
• Continuous Penetration Testing in the AI Era: What Bruce Schneier Told Us
• CISA's GitHub Credential Leak Postmortem: 7 Lessons Every CISO Must Act On Now

Join the Discussion

Three questions for practitioners running or advising on MFT estates:

• Progress ordered a full power-off for an admin-authenticated flaw. Does your playbook distinguish between vendor-ordered shutdowns and vendor-issued patches, and who in your org can authorize powering off a production file transfer tier?
• What detections do you run continuously on MFT hosts today: webshell drops in IIS paths, egress volume baselines, admin login anomalies, all three?
• The CVE publishes in about two weeks. Do you wait for IOCs or start compromise assessment on exposure alone?

Sources

• BleepingComputer: Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown (July 14, 2026)
• Help Net Security: Security threat prompts Progress to disable ShareFile accounts (July 13, updated July 14, 2026)
• The Hacker News: Progress tells ShareFile customers to shut down Storage Zone Controllers (July 10, 2026)
• BleepingComputer: Progress urges ShareFile admins to shut down servers (July 10, 2026)