1. Executive summary
A path traversal vulnerability (CVE-2026-15724) affects Progress ShareFile Storage Zones Controller in all versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can exploit the flaw to read arbitrary files from the server filesystem, write files to arbitrary directories, or enumerate file existence. The vulnerability is rated High severity by the National Vulnerability Database. EMEA financial services organisations running affected ShareFile Storage Zones Controller versions face risk of credential theft, configuration exposure, and potential server compromise via arbitrary file write. No CISA Known Exploited Vulnerabilities (KEV) catalogue entry was identified for this CVE at time of writing.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The vulnerability requires authenticated administrative access, which limits the trigger to a standard patch-management obligation rather than a distinctive fact that changes client obligations under a specific article.
3. Technical analysis & attack chain
Verified reference data: No verified reference data was resolved for this item. The CVSS score, severity rating (High), and CISA-KEV status below are drawn from the GitHub Advisory Database entry, which cites the National Vulnerability Database as the publishing source. This is a single-sourced advisory; verify against the NVD record before enforcement.
Severity: High (per NVD via GitHub Advisory Database).
CISA-KEV: Not listed at time of writing.
Affected versions
- Progress ShareFile Storage Zones Controller versions prior to 5.12.5
- Progress ShareFile Storage Zones Controller versions prior to 6.0.2
Fixed versions
- 5.12.5
- 6.0.2
Prerequisites: Authenticated administrative user access to the ShareFile Storage Zones Controller.
Attack chain (confirmed steps)
- Initial access — administrative authentication. The attacker possesses valid administrative credentials for the ShareFile Storage Zones Controller web interface. The vulnerability is not exploitable by unauthenticated users or low-privilege accounts.
- Path traversal exploitation. The authenticated administrative user submits crafted input containing path traversal sequences to a vulnerable component of the Storage Zones Controller. The specific endpoint, parameter, or HTTP method is not identified in the source material.
- Arbitrary file read. The traversal allows the attacker to read files outside the intended directory boundary, exposing arbitrary files on the server filesystem — potential targets include operating system files, application configuration files, and stored credentials.
- Arbitrary file write. The attacker can write files to arbitrary directories on the server, which could enable persistence, web shell deployment, or overwriting critical system or application files.
- File existence enumeration. The attacker can determine whether specific files exist on the server, enabling reconnaissance of the filesystem layout, installed software, and potential attack surface.
Technical gaps: The source material does not specify the vulnerable endpoint, HTTP method, parameter name, traversal sequence syntax, operating system impact differences, or whether the write capability can achieve remote code execution. No proof-of-concept exploit code, no specific file paths targeted, and no observed exploitation data are referenced.
4. Mitigation & containment
P1 — Within 24 hours
- Identify all Progress ShareFile Storage Zones Controller deployments across the estate. Record current version numbers.
- If any instance is running a version prior to 5.12.5 or 6.0.2, restrict administrative access to the Storage Zones Controller to a known-safe IP allowlist (e.g., jump host or management subnet only) at the network firewall or reverse-proxy layer.
- Review administrative account lists for the Storage Zones Controller and disable any unrecognised or dormant accounts. Reset passwords for all active administrative accounts where compromise is suspected.
P2 — Within 72 hours
- Upgrade all affected Storage Zones Controller instances to version 5.12.5 or 6.0.2. Progress has released these as the fixed versions.
- If immediate upgrade is not feasible, apply vendor-published workarounds or mitigations. No specific workaround is documented in the source material — consult the Progress security advisory and support portal directly.
- Audit Storage Zones Controller host filesystems for unexpected files written outside expected application directories, particularly in web-root paths, temporary directories, and startup locations. Focus on files with recent creation timestamps preceding the patch.
P3 — Within 7 days
- Validate that the upgrade was successful and the patched version is actively serving traffic.
- Review IIS or application logs for HTTP requests containing path traversal sequences (
../,..\, encoded variants%2e%2e%2f,%2e%2e%5c) targeting the Storage Zones Controller, covering the period from initial deployment to patch date. - Update asset inventory and vulnerability management records to reflect the patched state.
- Incorporate Progress ShareFile Storage Zones Controller into routine vulnerability scanning schedules.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
HTTP requests containing path traversal sequences (../, ..\, %2e%2e%2f, %2e%2e%5c) from authenticated administrative sessions |
IIS logs, Storage Zones Controller application logs, WAF logs | Medium — inferred from vulnerability class, not source-specified |
| Administrative session accessing or writing files outside expected ShareFile storage paths | Filesystem audit logs, EDR file-access monitoring | Medium — inferred from vulnerability description |
| File existence probes (HTTP responses indicating file found/not found) from administrative sessions | Application logs, WAF logs | Low — inferred from vulnerability description |
6. Detection
Insufficient indicators to author detection rules. The source material does not contain specific endpoint names, parameter names, command-line artefacts, file paths, registry keys, mutex names, or distinctive strings associated with the exploit. Path traversal sequence detection should be implemented at the WAF layer using standard traversal-pattern signatures, but no threat-specific YARA or Sigma rule can be authored from the available data.
7. Sources
- GitHub Advisory Database, "CVE-2026-15724 — In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability," https://github.com/advisories/GHSA-h264-2q7j-6mmw, published 2026-07-21.
8. Adverse Trace position
CVE-2026-15724 is a High-severity path traversal vulnerability in Progress ShareFile Storage Zones Controller affecting versions prior to 5.12.5 and 6.0.2, with fixes available in those two releases. The requirement for authenticated administrative access materially reduces the likelihood of opportunistic exploitation but does not eliminate risk — compromised admin credentials, insider threat, or lateral movement from a lower-privilege foothold could provide the necessary access. EMEA financial services clients running affected versions should treat this as a P2 remediation: restrict administrative access immediately and upgrade to 5.12.5 or 6.0.2 within 72 hours. This advisory is single-sourced from the GitHub Advisory Database entry referencing the NVD record; Adverse Trace will update this note when the full NVD entry, CVSS vector, and any vendor advisory with additional mitigations or workarounds are published. No CISA-KEV entry or observed exploitation has been reported at time of writing.
Published via PulseTrace — Adverse Trace threat intelligence.