EUVD-2026-97365
GHSA-474p-wmhw-pxfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Storage Zones Controller
-
DeliveryCraft malicious outbound-request parameters
-
ExploitTrigger server-side request to local handler
-
ExecutionAbuse unsafe JSONP response formatting
-
ImpactPerform unauthorized queue operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | No authentication, user interaction, or special privileges are required to reach the flaw (AV:N/AC:L/PR:N/UI:N) - the single prerequisite is network reachability of the Progress ShareFile Storage Zones Controller (v5.12.6 or below), typically an internet- or intranet-exposed on-premises component. Exploitation chains three specific defects: improper validation of outbound request destinations/parameters, unsafe JSONP response formatting, and insufficient validation on the queue service; all three code paths exist in the default product and no non-default feature toggle is named in the advisory. Limiting factors: impact is constrained to SSRF against local handlers and unauthorized queue operations (no confidentiality disclosure, only low integrity/availability effect, scope unchanged), so controllers isolated from the internet or fronted by a proxy that restricts reachability materially reduce real-world exposure. |
| Impact | This is a medium-severity issue (CVSS 6.5) whose vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L describes a remote, low-complexity, unauthenticated attack requiring no user interaction - attractive characteristics - but with deliberately constrained impact: no confidentiality loss (C:N) and only low integrity and availability impact (I:L/A:L), consistent with an SSRF-to-local-handler plus queue-manipulation chain rather than full compromise. No EPSS score, CISA KEV listing, or public PoC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only signal elevating it is the easy, pre-auth network reachability. Net: a worthwhile patch priority for internet-exposed Storage Zones Controllers because it is pre-auth and low-complexity, but not an emergency - the capped impact (no data disclosure, only partial integrity/availability effects) keeps real-world risk moderate. Note a labeling conflict: the input Tags assert 'Authentication Bypass', yet the description and PR:N both indicate the attacker is already unauthenticated and the flaw is SSRF/JSONP/queue-validation - the tag appears mislabeled and should be verified. EPSS absence is a data gap, not evidence of low risk. |
| Exploit ScenarioDerived | A remote unauthenticated attacker locates an internet-facing Progress ShareFile Storage Zones Controller (v5.12.6 or below) and sends crafted requests that abuse improper outbound-destination validation and unsafe JSONP formatting to coerce the server into issuing requests to unintended local handlers. Chaining this with weak queue-service validation, the attacker performs unauthorized queue operations against the internal service. No public proof-of-concept is identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means exploitation is straightforward if the controller is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Server-side request forgery in Progress ShareFile Storage Zones Controller 5.12.6 and earlier lets a remote, unauthenticated attacker drive the component into issuing requests to unintended local handlers and performing unauthorized operations against its queue service, with no user interaction or privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is deliberately constrained - no confidentiality loss (C:N) and only low integrity and availability effects (I:L/A:L) - producing a medium severity score of 6.5, and no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited to on-premises Storage Zones Controller instances that are network-reachable by the attacker, an extension or management component that is sometimes deployed internet-facing.
RemediationAI
Patch status is not confirmed by the supplied data, so the authoritative fix version must be taken from the vendor advisory at https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26 - administrators should apply the latest Storage Zones Controller release listed there rather than assuming 5.12.6 is the final affected build. Until the controller is on a fixed release, prioritize reducing reachability: restrict access to the controller's management and API interfaces to trusted management networks only, since the assessed vector requires network reachability but no authentication (AV:N/PR:N) - the trade-off is that administrative access must then be brokered through a jump host or VPN; front the component with a reverse proxy or WAF that rejects or strips JSONP-style callback parameters on requests to the controller, which mitigates the unsafe JSONP response formatting path but may break any legitimate integrations relying on JSONP; apply host-level egress filtering so the controller process cannot reach loopback-only or internal management handlers beyond those it genuinely requires, accepting that mis-scoped egress rules can break storage-zone brokering; and monitor the queue service for unexpected or unauthorized queue operations, since successful exploitation produces low-integrity and low-availability effects there that may be the first observable symptom. Isolating the controller from the internet materially lowers real-world exposure because the entire chain is network-reachability dependent, but it does not remove the underlying defect for an attacker already positioned on the internal network.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-20 (Improper Input Validation): the vendor describes three distinct validation defects that can be chained - improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on the queue service. The first provides the SSRF primitive, allowing attacker-influenced request targets and parameters to reach unintended local handlers on the controller host; the unsafe JSONP response formatting compounds this by rendering responses in a form an attacker can influence or consume, which is the classic enabler for cross-origin data routing and callback abuse; the queue-service weakness then permits unauthorized queue operations, explaining the low integrity and availability impact in the assessed vector. The assessed scope is unchanged (S:U) and confidentiality impact is none (C:N), so the chain does not appear to cross a trust boundary into credential or data disclosure - it is an SSRF-to-local-handler plus queue-manipulation issue rather than full compromise. Storage Zones Controller is the on-premises Windows component that brokers customer-managed storage zones into the ShareFile cloud service, which is why its host network placement strongly determines real-world risk. No CPE strings were supplied with this record; affected-product identification therefore rests on the vendor advisory rather than NVD CPE enumeration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Remote pre-auth, low-complexity chain (AV:N/AC:L/PR:N/UI:N); no data disclosure (C:N) with only partial integrity/availability impact from queue tampering and SSRF to local handlers.
Primary rating from Vendor (progress).
CVSS VectorVendor: progress
DescriptionCVE.org
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB