EUVD-2026-60197
GHSA-26xg-7mw9-cm54
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent vector and low privileges directly reflect the requirement for internal network adjacency and network share write access; full C/I/A impact is consistent with arbitrary code execution on the controller host.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
AnalysisAI
Unsafe deserialization in Progress ShareFile Storage Zones Controller v5.12.5 and below exposes the controller host to arbitrary code execution by any low-privileged user holding write access to a connected network share. Rooted in CWE-502 (Deserialization of Untrusted Data), the flaw processes attacker-controlled file metadata without integrity validation, yielding full host compromise with high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific, concrete conditions: (1) the attacker must hold write access to a Network share that is connected to and processed by the ShareFile Storage Zones Controller - this is an explicit prerequisite stated in the CVE description and reflected in CVSS PR:L; and (2) the attacker must be network-adjacent to the controller (CVSS AV:A), meaning they reside on the same internal network segment, VLAN, or VPN-connected environment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.0 with AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H characterizes a high-severity internal threat: network adjacency and low-privilege authenticated access constrain the exposed population compared to an internet-facing flaw, but the low attack complexity means escalation is straightforward once those prerequisites are satisfied. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An internal user or compromised account with write access to a network share connected to the ShareFile Storage Zones Controller crafts malicious serialized file metadata and uploads it to that share, causing the controller to deserialize the payload during normal file processing operations. Because attack complexity is low once the adjacency and share write-access prerequisites are met, the attacker achieves arbitrary operating system command execution in the context of the SZC service process. … |
| Remediation | Organizations should upgrade Progress ShareFile Storage Zones Controller beyond v5.12.5 immediately, consulting the vendor advisory at https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information for the current patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of ShareFile Storage Zones Controller in your environment and determine which are running version 5.12.5 or below; immediately restrict write access to all connected network shares to administrative accounts only and enable audit logging for file operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today