What is the CVSS score of CVE-2026-15724?

CVE-2026-15724 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of ShareFile Storage Zones Controller are affected by CVE-2026-15724?

Progress ShareFile Storage Zones Controller (versions before 5.12.5 and 6.0.2) contains a privilege escalation flaw allowing administrators to directly access and modify files on hosting servers.

How to fix or mitigate CVE-2026-15724?

Within 24 hours: identify and catalog all on-premises Storage Zones Controller instances by version; assess whether systems host sensitive data and review administrative access logs for anomalies. Within 7 days: upgrade all affected instances to version 5.12.5 (5.x line) or 6.0.2 (6.x line) following Progress vendor documentation; perform post-upgrade functionality testing. Within 30 days: complete deployment across all infrastructure, conduct a full administrative access audit, implement audit logging for administrative file operations, and establish ongoing monitoring for suspicious administrative activity on Storage Zones Controller hosts.

ShareFile Storage Zones Controller CVE-2026-15724

EUVD-2026-46325 HIGH

Path Traversal (CWE-22)

2026-07-21 ProgressSoftware

GHSA-h264-2q7j-6mmw

Path Traversal Sharefile Storage Zones Controller Progress

8.7

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable admin function (AV:N/AC:L) but requires administrative auth (PR:H); traversal into host filesystem beyond the app breaks scope (S:C) with arbitrary read and write (C:H/I:H) and no availability impact (A:N).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 17:32 vuln.today

CVE Published

Jul 21, 2026 - 16:55 cve.org

HIGH 8.7

DescriptionCVE.org

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.

AnalysisAI

Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrative user break out of intended directory boundaries to read arbitrary files, write files to arbitrary locations, and probe for file existence on the underlying server. Rated CVSS 8.7 with a scope change (S:C), the flaw converts application-level admin privileges into host filesystem read/write, but exploitation requires high privileges (PR:H) and there is no public exploit identified at time of analysis. Affected organizations are those self-hosting the on-premises Storage Zones Controller component that fronts ShareFile storage zones.

Technical ContextAI

The Storage Zones Controller (SZC) is the on-premises IIS/.NET web component in the Progress (formerly Citrix) ShareFile platform that mediates access between the ShareFile control plane and customer-managed storage zones, handling file upload/download, chunking, and metadata operations. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): user- or admin-supplied path parameters are used to compose filesystem paths without adequate canonicalization or constraint, so sequences such as '../' or absolute paths escape the intended storage root. Because SZC runs as a privileged service account with access to the host filesystem, the traversal yields read, write, and existence-check primitives against files well outside the ShareFile storage directory. The single affected CPE is cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade the Storage Zones Controller to 5.12.5 (for 5.x deployments) or 6.0.2 (for 6.x deployments), the first fixed releases per Progress. Because exploitation requires an authenticated administrative user, compensating controls until patching center on tightening and monitoring SZC admin access: restrict who holds SZC/ShareFile administrator roles and enforce MFA on those accounts, limit network reachability of the SZC management interface to trusted administrative networks or a VPN so the network vector cannot be reached broadly, and enable/scrutinize IIS and application logs for anomalous file-path parameters (e.g., '../' sequences or absolute paths) and unexpected file writes by the SZC service account. Running the SZC service under a least-privilege account limits the blast radius of the arbitrary read/write primitive, though it does not eliminate the traversal itself. Consult the vendor advisory at https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information and verify the fixed build in the ShareFile admin console after upgrading.