ShareFile Storage Zones Controller CVE-2026-16137

Exploitation requires possession of valid zone credentials for the targeted ShareFile Storage Zones Controller instance, corresponding to PR:H in the CVSS 3.1 vector - exploitation is explicitly limited to authenticated parties. The resumable upload initiation endpoint must be reachable over the network (AV:N), and no user interaction is needed beyond the attacker's own requests. The following conditions limit exploitation: (1) the attacker must hold legitimate zone credentials or have stolen them through a prior compromise step; (2) the deployment must be running Storage Zones Controller v5.12.5 or earlier on-premises - cloud-managed ShareFile zones are not affected; (3) the reachable write paths are bounded by the service account's filesystem permissions, so a correctly scoped service account restricted to non-executable, non-web-accessible directories would prevent code execution even if traversal succeeds. There are no special non-default configuration requirements beyond running the affected version with zone credentials in use.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) scores 7.2 High and accurately reflects the exploitation model: the attack is network-reachable with low complexity, but the PR:H requirement anchors risk to parties who already possess valid zone credentials. This substantially narrows the realistic attacker population compared to unauthenticated flaws - exploitation is most likely via credential theft, insider threat, or abuse by a legitimately credentialed administrator. The full C:H/I:H/A:H impact triad reflects the worst-case outcome of arbitrary file write escalating to code execution under the service account. No EPSS score was provided in the input data; absence of a KEV listing and no confirmed public POC suggest active exploitation is not yet widespread. However, the clear exploitation path (path traversal to file write to execution) means weaponization is straightforward for anyone with zone credentials. Organizations running internet-exposed Storage Zones Controllers or those with broadly shared zone credentials should treat this as urgent. The CVSS score is consistent with the description - no conflicting signals detected.

An attacker who has stolen or otherwise obtained valid zone credentials for a target organization's Storage Zones Controller sends a crafted HTTP request to the resumable upload initiation endpoint, embedding directory traversal sequences in the path parameter to redirect the write target to a web-accessible directory (e.g., the application's web root). The attacker uploads a web shell or malicious script to that location; because no public POC has been identified at time of analysis the exact request format is not publicly documented, but the mechanics are straightforward for anyone familiar with path traversal patterns. The attacker then issues a follow-up HTTP request to the planted file's URL, achieving remote code execution under the service account's operating system identity.