Sharefile Storage Zones Controller CVE-2026-2699

No special conditions - remote unauthenticated exploitation against default configurations of Progress ShareFile Storage Zones Controller versions 5.12.3 and earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible exploitation with low attack complexity, no required privileges, and no user interaction. Primary limiting factor is network exposure: Storage Zones Controllers deployed behind corporate firewalls or restricted to internal networks significantly reduce attacker accessibility compared to internet-facing deployments. Secondary limiting factor is target identification: attackers must locate Storage Zones Controller instances through active reconnaissance (distinctive HTTPS certificates, specific URL patterns, Shodan queries) rather than exploiting ubiquitous services. No specific feature enablement, non-default configuration, or protocol support required beyond the base Storage Zones Controller installation. All deployment modes of affected versions are exploitable if network-reachable by attacker.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. CVSS 9.8 with maximum ratings (network vector, no authentication, high impact across confidentiality/integrity/availability) indicates critical theoretical severity. SSVC framework confirms automatable exploitation with total technical impact and publicly available POC, typically warranting immediate action. However, EPSS exploitation probability of 0.41% (61st percentile) suggests limited observed exploitation in the wild despite POC availability since watchTowr Labs publication. This discrepancy likely reflects the specialized deployment profile: Storage Zones Controllers are deployed by enterprise ShareFile customers requiring on-premises storage, not mass-market SaaS users. Attack surface is further constrained by typical enterprise network segmentation placing storage controllers behind corporate firewalls rather than directly internet-exposed. No CISA KEV listing at time of analysis, indicating no confirmed active exploitation campaigns detected by federal agencies. Priority assessment: High urgency for organizations with internet-facing Storage Zones Controllers or those in regulated industries; moderate urgency for properly segmented internal deployments with compensating network controls. The gap between technical severity and observed exploitation suggests targeted rather than opportunistic threat actor interest.

Remote unauthenticated attacker identifies internet-exposed ShareFile Storage Zones Controller through network reconnaissance (Shodan, certificate transparency logs showing ShareFile-specific TLS certificates). Attacker directly navigates to restricted configuration page URLs without providing credentials, bypassing intended authentication due to CWE-698 execution-after-redirect flaw. Once accessing administrative interface, attacker modifies system configuration to inject malicious code (file upload handlers, scheduled tasks, plugin installations) achieving remote code execution with SYSTEM/Administrator privileges on the Windows host. Publicly available POC from watchTowr Labs (https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699) provides weaponized exploit code, lowering skill barrier for opportunistic attackers.