Unauthenticated File Exfiltration Vulnerabilities Found in Progress ShareFile
Critical Vulnerabilities in Progress ShareFile Enable Unauthenticated File Exfiltration
Recent research has uncovered two severe flaws in Progress ShareFile, a widely used enterprise file transfer solution, which can be combined to enable unauthorized access to sensitive files.
The Flaws:
- CVE-2026-2699: Authentication Bypass
- CVE-2026-2701: Remote Code Execution
The first vulnerability allows an attacker to gain access to the administrator interface without proper authorization. An attacker can then manipulate storage zone configurations, including file paths and sensitive security settings.
The second vulnerability enables remote code execution through the abuse of file upload functionality to deploy malicious web shells.
Approximately 30,000 SZC instances are exposed online, with around 700 identified by the ShadowServer Foundation.
Progress has addressed these vulnerabilities in ShareFile version 5.12.4, released on March 10. Organizations utilizing susceptible versions of the ShareFile Storage Zone Controller are strongly advised to update their systems promptly to prevent potential breaches.
Related Security Incidents:
- A data breach affecting Hims & Hers, a US-based health and wellness company, resulting from a social engineering attack.
- A suspected Iran-linked hacktivist group claiming responsibility for breaching the Dubai International Airport’s database, potentially compromising passport information belonging to American citizens.
These events highlight the ongoing need for organizations to prioritize robust cybersecurity measures, including regular software updates, employee education, and advanced threat detection capabilities.