Sharefile Storage Zones Controller CVE-2026-2701

Requires valid high-privilege administrative credentials to Progress ShareFile Storage Zones Controller (CVSS PR:H). Exploitation targets the file upload functionality accessible to authenticated administrators, not default unauthenticated endpoints. The vulnerability affects only deployments using on-premises Storage Zones Controller component versions 0 through 5.12.3; ShareFile cloud-only configurations without on-premises storage are not vulnerable. No user interaction is required once the attacker has authenticated (UI:N). Network accessibility to the Storage Zones Controller administrative interface is required (AV:N), but many deployments restrict this to internal networks or VPN, limiting external attack surface. Attack complexity is low (AC:L) once authentication is achieved, indicating reliable exploitation without race conditions or environment-specific requirements.

Risk assessment reveals mixed signals requiring careful interpretation. CVSS 9.1 (Critical) indicates maximum impact potential with network attack vector, low complexity, and scope change. However, the PR:H (high privileges required) significantly narrows the threat actor pool to compromised administrators or malicious insiders. SSVC framework confirms exploitation status as 'none' (no active exploitation observed) and 'not automatable' (requires authenticated session), though technical impact is 'total' (complete system control). EPSS score of 0.19% (percentile 41%) suggests below-average exploitation probability despite public POC availability - likely because high-privilege authentication acts as an effective barrier to mass exploitation. The publicly available exploit from Italian CERT indicates proof-of-concept feasibility, but absence from CISA KEV suggests no widespread campaigns. Real-world priority depends on ShareFile deployment model: highest risk in multi-tenant environments where administrative account compromise leads to scope-breaking lateral movement; moderate risk in single-tenant deployments where defense-in-depth (privileged access management, file integrity monitoring) provides additional controls. Organizations should verify whether their ShareFile deployment uses on-premises Storage Zones Controller versus cloud-only architecture.

Attacker compromises ShareFile administrative credentials through phishing, credential stuffing, or previous vulnerability exploitation. Authenticated as high-privilege user, attacker accesses file upload functionality in Storage Zones Controller and uploads a web shell or compiled executable disguised as legitimate file type. Publicly available exploit code (confirmed by Italian CERT ACN) demonstrates reliable exploitation technique. Upon upload, the malicious file executes in the server's security context, granting the attacker remote command execution with system-level privileges and scope-breaking access to the underlying host operating system.