ShareFile SZC CVE-2026-16139

Exploitation requires an authenticated zone administrator session on the Progress ShareFile Storage Zones Controller, confirmed by both the CVSS vector (PR:H) and the vulnerability description - unauthenticated external attackers cannot exploit this without first obtaining zone admin credentials. The vulnerable code path is specifically within the download preparation flow, so the attacker must interact with that staging functionality via the network-accessible interface (AV:N). Remote code execution impact is explicitly limited to v5 branch instances (≤ 5.12.5); v6 instances (≤ 6.0.2) exhibit the arbitrary file write primitive but RCE has not been vendor-confirmed on that branch. Only on-premises SZC deployments are indicated as affected; cloud-hosted ShareFile tenants are not confirmed vulnerable.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) correctly reflects high potential impact gated behind a significant prerequisite: zone administrator authentication (PR:H). This substantially constrains real-world exposure compared to unauthenticated flaws - an attacker must first possess or compromise a zone admin account, limiting the threat surface to insider threats, credential-theft scenarios, or targeted phishing of privileged SZC users. EPSS data was not provided in the input and cannot be assessed. No CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis. No public POC has been identified. The S:U metric (unchanged scope) aligns with exploitation remaining bounded to the SZC server. Despite the PR:H constraint, the combination of AV:N (network-reachable), AC:L (no additional complexity once credentials are held), and confirmed RCE on v5 makes this a genuine priority for organizations running on-premises SZC - especially where zone admin accounts are shared, weakly protected, or exposed to phishing.

A threat actor who has compromised or legitimately holds zone administrator credentials for an on-premises ShareFile Storage Zones Controller instance crafts a malicious download preparation request containing path traversal sequences, causing the SZC server to write an attacker-controlled payload - such as an ASPX web shell - to an arbitrary filesystem location accessible by the web server. On v5 instances (≤ 5.12.5), the attacker then sends an HTTP request to the dropped file to trigger execution, achieving remote code execution under the SZC web server's process context. No public exploit code has been identified at time of analysis.