Storage Zones Controller EUVD-2026-97366

Exploitation requires the attacker to control copy queue work items in the ShareFile Storage Zones Controller (v5.12.6 and below) and to win a race condition in the queue-item acknowledgement path, where a callback URL is processed without validation, causing FileCopyService to consume attacker-controlled metadata and content. Limiting factors: the attack is locally scoped and high-complexity (AV:L/AC:H) because it depends on timing a race window and on already being able to influence copy queue work, which is not a default anonymous capability; impact is bounded to limited integrity and availability (C:N, I:L, A:L) with no confidentiality exposure. Despite the input's PR:N rating, the requirement to control copy queue work implies a position of prior access that defenders should weigh.

This is a low-to-moderate priority issue that does not warrant emergency patching but should be remediated in normal maintenance cycles. The input CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/C:N/I:L/A:L) describes a locally-reachable, high-complexity flaw with no confidentiality impact and only limited integrity and availability impact, which is consistent with the quoted CVSS base score of 4.0 (Medium). Several real-risk-reducing signals align: AC:H reflects the required race condition, and the description independently confirms two non-trivial prerequisites ('control over copy queue work' plus winning a race). No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. CONFLICTS TO VERIFY: (1) the CWE is CWE-321 (Use of Hard-coded Cryptographic Key), which does not match the described callback-URL-validation/race-condition behavior - verify the CWE mapping with the vendor. (2) The vector states PR:N (unauthenticated) yet the description requires 'control over copy queue work,' which implies some prior access or position - treat the unauthenticated claim with caution. (3) The lone tag is 'Information Disclosure,' but the vector sets C:N and the described impact is attacker-controlled metadata/content being consumed, i.e. an integrity problem, not disclosure.

An attacker who can influence copy-queue work items supplies a malicious callback URL that the Storage Zones Controller fails to validate when sending acknowledgements. By winning a race condition, the attacker causes FileCopyService to ingest attacker-controlled metadata and file content into the copy operation. No public exploit code is known, and the high attack complexity (race window) makes reliable exploitation difficult.