{"id":"CVE-2026-2699","published":"2026-04-02T13:04:00Z","modified":"2026-04-08T15:25:21Z","title":"EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)","vendor":"Progress","product":"ShareFile Storage Zones Controller","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress","product":"ShareFile Storage Zones Controller","versions":["<= 5.12.3"]}],"description":{"text":"Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Progress ShareFile Storage Zones Controller (SZC) contains an Execution After Redirect flaw and an improper access control weakness that together expose its restricted configuration pages. An unauthenticated attacker with network access can reach those pages without user interaction or special configuration, change the system configuration, and potentially achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.58386,"percentile":0.99096,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-07-10","exploitedFirstSeen":"2026-07-10","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-10&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-10"},{"url":"https://previdian.com/CVE-2026-2699","date":"2026-07-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-12&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-13&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-17&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-22&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-23&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-24&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-25&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-26&host_type=src&vulnerability=cve-2026-2699","date":"2026-07-26"}],"evidenceTotal":81,"provenance":"source"},"exploited":true,"otx":{"pulseCount":11,"pulses":[{"name":"Progress ShareFile Storage Zone Controller Pre-Auth RCE Chain","url":"https://otx.alienvault.com/pulse/6accf9f2815b12f5cf478464","created":"2026-10-12"},{"name":"BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector","url":"https://otx.alienvault.com/pulse/69f33e7bd3afa0cf45245a5c","created":"2026-04-30"},{"name":"BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector - Arctic Wolf","url":"https://otx.alienvault.com/pulse/69f1d32e6b8143fd0e42df04","created":"2026-04-29"},{"name":"Known_Cve | Apr 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69d90ecbfe61adc1f3d89b8f","created":"2026-04-10"},{"name":"Known_Cve | Apr 10, 2026","url":"https://otx.alienvault.com/pulse/69d7bd98c6ff9f8a5a310261","created":"2026-04-09"},{"name":"Known_Cve | Apr 9, 2026","url":"https://otx.alienvault.com/pulse/69d66b5f37ba49398ad066dd","created":"2026-04-08"},{"name":"Known_Cve | Apr 8, 2026","url":"https://otx.alienvault.com/pulse/69d51903148f2b12ebc62d05","created":"2026-04-07"},{"name":"Known_Cve | Apr 7, 2026","url":"https://otx.alienvault.com/pulse/69d3c8b63434db28e734c77d","created":"2026-04-06"},{"name":"Known_Cve | Apr 6, 2026","url":"https://otx.alienvault.com/pulse/69d274d73531da3a781cc03e","created":"2026-04-05"},{"name":"Known_Cve | Apr 5, 2026","url":"https://otx.alienvault.com/pulse/69d1156f88bf34624d555f2e","created":"2026-04-04"}],"provenance":"machine"},"cwes":[{"id":"CWE-698","name":"Execution After Redirect (EAR)"},{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26","tags":["vendor-advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-18218","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18218","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-03-25","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699","repos":[{"name":"watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699","url":"https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699","stars":3,"created":"2026-03-25"},{"name":"0xBlackash/CVE-2026-2699","url":"https://github.com/0xBlackash/CVE-2026-2699","stars":0,"created":"2026-04-07"}]},"nuclei":[{"id":"CVE-2026-2699","name":"Progress ShareFile Storage Zones Controller - Authentication Bypass","severity":"critical","path":"http/cves/2026/CVE-2026-2699.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2699.yaml"}],"first":{"date":"2026-03-25","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699"},"provenance":"source"},"exploitRefs":["https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699"],"flow":[],"timeline":[{"date":"2026-03-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699","provenance":"source"},{"date":"2026-04-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-2699","provenance":"source"},{"date":"2026-07-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-10&host_type=src&vulnerability=cve-2026-2699","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":74.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 113 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9910"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.45,"detail":"11 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}