Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption

1. Executive summary

Progress Software has confirmed that a high-severity zero-day vulnerability in ShareFile Storage Zones Controller (SZC) versions 5.x and 6.x triggered an emergency service shutdown on July 10, 2026. The flaw is a path traversal bug exploitable by authenticated administrative users, enabling arbitrary file read, arbitrary file write, and filesystem enumeration on the underlying Windows server. Progress has released patched versions and is restoring access to customers who apply them. EMEA financial services running on-premises SZC instances face risk of filesystem-level compromise of internet-facing Windows servers; Progress states it has no evidence of unauthorised access to customer data, but the aggressive response (full shutdown) suggests defenders should assume worst-case posturing until investigations conclude.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While the incident involves an ICT disruption and a third-party software vendor, the trigger facts here — a vulnerability in on-premises software, a vendor-directed shutdown, and patch availability — do not distinctively engage any article beyond what would apply to any security patching event. The generic obligations around incident management and third-party risk are not specifically triggered by a fact unique to this item.

3. Technical analysis & attack chain

Affected products: ShareFile Storage Zones Controller (SZC), versions 5.x and 6.x. SZC is the on-premises, customer-managed Windows server component of ShareFile that allows organisations to store files on their own infrastructure while using Progress's cloud for authentication and management. SZC instances typically sit on internet-facing Windows servers.

Vulnerability mechanism: Path traversal. Per Progress's private communication to customers (shared on Reddit), the defect allows an authenticated administrative user to:

• Read arbitrary files accessible to the application's service account
• Write attacker-controlled content to arbitrary directories
• Enumerate the server filesystem layout

Attack chain (confirmed steps)

1. Pre-requisite — authenticated administrative access. The attacker must possess administrative credentials for the ShareFile environment. Progress has not disclosed whether the vulnerability can be chained with an authentication bypass to achieve unauthenticated exploitation.
2. Path traversal exploitation. Using administrative access, the attacker exploits the path traversal defect to read or write files outside intended directory boundaries, operating with the privileges of the SZC application's service account.
3. Filesystem interaction. The attacker can enumerate the filesystem layout, read sensitive files accessible to the service account, or write malicious content to arbitrary directories — potentially enabling subsequent code execution or persistence.

Unconfirmed / caveated elements

• No CVE identifier, CVSS score, or CWE classification has been published by Progress or assigned in NVD at the time of writing. Verified reference data for this item returned no resolved CVE. Progress describes the flaw as "high-severity" but has not published a CVSS vector. This advisory does not independently assign a score.
• No CISA-KEV listing has been identified for this vulnerability at time of writing.
• Speculation on unauthenticated RCE: A Reddit user speculated the shutdown response implies "an unauthenticated RCE being exploited in the wild." This is unconfirmed community speculation, not a vendor statement. WatchTowr CEO Benjamin Harris separately noted that a vulnerability requiring administrative access would not normally trigger such an aggressive response, suggesting there may be undisclosed elements — possibly attacker activity observed by Progress. This is analyst commentary, not confirmed fact.
• No confirmed threat actor attribution. No named actor has been identified in the source material. No MITRE ATT&CK profile is available.
• Historical context (not linked to this incident): Progress previously patched two critical vulnerabilities in ShareFile Storage Zone Controller v5 that could be chained into unauthenticated RCE. Progress has not linked the current incident to those prior bugs. The vendor also suffered the MOVEit Transfer mass-exploitation campaign by Clop ransomware in 2023–2024; no connection to this incident has been suggested.
• No evidence of customer compromise: Progress states it has "no evidence of unauthorized access to any ShareFile customer account or data" and has "not identified any active threat." This is the vendor's position; independent verification is not available.

4. Mitigation & containment

P1 — Within 24 hours

1. Apply the patched version. Progress has released patched versions for SZC 5.x and 6.x. Identify all SZC instances in your environment, confirm version (5.x or 6.x), and upgrade immediately. Access is being restored only to customers running patched versions.
2. Verify SZC server integrity before reconnecting. If your SZC server was internet-facing and running an unpatched version between July 10 and patch application, treat the host as potentially compromised. Before powering back on: - Review Windows Event Logs for anomalous service account activity, unexpected process creation, and file writes outside expected SZC directories. - Check for unexpected files in arbitrary directories (per the path traversal write capability). - Review IIS logs (SZC runs on IIS) for anomalous authenticated administrative requests. - Consider forensically imaging the host before remediation if compromise is suspected.
3. Restrict SZC internet exposure. If the patched SZC does not require direct internet exposure, place it behind a VPN or zero-trust network access gateway until the full vulnerability details are published and assessed.

P2 — Within 72 hours

4. Rotate ShareFile administrative credentials. If any administrative account sessions were active during the exposure window, rotate credentials and revoke active sessions/tokens.
5. Audit administrative access logs. Review all administrative authentication events and actions in the ShareFile environment from July 1 onward for indicators of anomalous or unauthorised administrative activity.
6. Review service account permissions. The path traversal operates with the privileges of the SZC application's service account. Audit what files and directories that account can access; restrict to the minimum required.

P3 — Within 7 days

7. Conduct a retrospective filesystem audit on all SZC hosts for files written outside expected application directories during the exposure window.
8. Monitor for CVE publication and CISA-KEV addition. No CVE has been assigned at time of writing. Track NVD and CISA for publication; reassess severity and exposure if the CVSS vector or KEV listing indicates broader exploitability than the "authenticated admin" description suggests.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material describes the vulnerability mechanism (path traversal by authenticated admin users) but provides no specific artefacts — no file paths, filenames, registry keys, mutex names, command-line strings, or network signatures — that could populate a YARA or Sigma rule. The behavioural indicators in §5 should be implemented as environment-specific log queries rather than generic detection rules.

7. Sources

• SecurityWeek — Progress Confirms Zero-Day Vulnerability Behind ShareFile Disruption — https://www.securityweek.com/progress-confirms-zero-day-vulnerability-behind-sharefile-disruption/ — 2026-07-15
• BleepingComputer — Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown — https://www.bleepingcomputer.com/news/security/progress-confirms-sharefile-zero-day-flaw-behind-storage-zone-shutdown/ — 2026-07-15
• The Register — Progress orders emergency ShareFile server shutdown over mystery security threat — https://www.theregister.com/security/2026/07/13/progress-orders-emergency-sharefile-server-shutdown-over-mystery-security-threat/5270281 — 2026-07-13
• The Hacker News — URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat — https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html — 2026-07-13
• Help Net Security — Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers — https://www.helpnetsecurity.com/2026/07/13/progress-sharefile-security-threat/ — 2026-07-13
• DataBreaches.net — Progress urges ShareFile admins to shut down servers over "credible" threat — https://databreaches.net/2026/07/13/progress-urges-sharefile-admins-to-shut-down-servers-over-credible-threat/ — 2026-07-13
• SecurityWeek — Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns — https://www.securityweek.com/progress-prompts-sharefile-storage-zone-controller-shutdown-amid-security-concerns/ — 2026-07-13

8. Adverse Trace position

Progress has confirmed a high-severity zero-day path traversal vulnerability in ShareFile Storage Zones Controller versions 5.x and 6.x, exploitable by authenticated administrative users for arbitrary file read, write, and filesystem enumeration. The vendor's decision to force a full shutdown of customer servers — rather than simply issuing a patch — is disproportionate to a standard authenticated-admin vulnerability and suggests either observed exploitation, an undisclosed chaining path, or both. No CVE, CVSS vector, or CISA-KEV entry exists at time of writing; no threat actor attribution is available; and Progress denies evidence of customer compromise — all claims that are single-sourced to the vendor and should be verified independently. EMEA financial services running SZC 5.x or 6.x should patch immediately, treat internet-exposed unpatched hosts as potentially compromised, and conduct retrospective forensic review before reconnecting. We will monitor for CVE publication, CISA-KEV addition, and any emergence of IOCs or actor attribution, and will update this advisory accordingly.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.