What is the CVSS score of EUVD-2026-60197?

EUVD-2026-60197 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ShareFile Storage Zones are affected by EUVD-2026-60197?

Progress ShareFile Storage Zones Controller versions 5.12.5 and below are vulnerable to arbitrary code execution through unsafe deserialization, allowing low-privileged users with network share write…

How to fix or mitigate EUVD-2026-60197?

Within 24 hours, identify all instances of ShareFile Storage Zones Controller in your environment and determine which are running version 5.12.5 or below; immediately restrict write access to all connected network shares to administrative accounts only and enable audit logging for file operations. Within 7 days, implement network segmentation to isolate affected controllers from general user networks, review all user access controls to shares connected to affected systems, and establish daily monitoring of vendor advisories. Within 30 days, develop and test an upgrade plan for all affected systems once a patched version becomes available, and consider interim deployment of additional compensating controls such as file integrity monitoring and sandboxed share access.

ShareFile Storage Zones EUVD-2026-60197

| CVE-2026-16138 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-17 security@progress.com

GHSA-26xg-7mw9-cm54

RCE Deserialization Sharefile Storage Zones Controller Progress

8.0

CVSS 3.1 · Vendor: progress

Severity by source

Vendor (progress) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Adjacent vector and low privileges directly reflect the requirement for internal network adjacency and network share write access; full C/I/A impact is consistent with arbitrary code execution on the controller host.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (progress).

CVSS VectorVendor: progress

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 14:34 vuln.today

CVE Published

Aug 17, 2026 - 14:20 cve.org

HIGH 8.0

DescriptionCVE.org

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

AnalysisAI

Unsafe deserialization in Progress ShareFile Storage Zones Controller v5.12.5 and below exposes the controller host to arbitrary code execution by any low-privileged user holding write access to a connected network share. Rooted in CWE-502 (Deserialization of Untrusted Data), the flaw processes attacker-controlled file metadata without integrity validation, yielding full host compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Progress ShareFile Storage Zones Controller (SZC) is the on-premises component of the Progress ShareFile enterprise file-sharing platform, responsible for managing storage backends - including UNC-path network shares - for file upload, download, and metadata operations. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data): the controller deserializes file metadata supplied via a connected network share without first verifying the integrity or trustworthiness of that data. Deserialization of attacker-controlled objects is a well-documented RCE class that typically yields OS-level code execution in the context of the deserializing process. The CVSS vector AV:A indicates the attack requires adjacent network access - the attacker must be on the same internal network segment or VPN-connected environment as the controller - and PR:L reflects the requirement for at least write-level access to a network share, a common entitlement in enterprise ShareFile deployments. No CPE string was provided in the available data.

RemediationAI

Organizations should upgrade Progress ShareFile Storage Zones Controller beyond v5.12.5 immediately, consulting the vendor advisory at https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information for the current patched release. An exact patched version number is not independently confirmable from the provided data - the advisory URL must be consulted directly for the authoritative fixed version. As a compensating control while patching, restrict write access to network shares connected to the Storage Zones Controller to the absolute minimum set of accounts that operationally require it, since share write access is a prerequisite for exploitation (PR:L); reducing this population directly reduces attack surface. Additionally, enforce network segmentation so the SZC host is reachable only from authorized internal subnets, addressing the AV:A adjacency requirement - note, however, that segmentation alone does not eliminate risk if accounts with legitimate share write access are compromised. Audit current share ACLs to identify and revoke any overly broad write permissions before the patch can be applied.