Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns

1. Executive summary

Progress Software has directed ShareFile customers to immediately manually shut down all Windows servers hosting on-premises Storage Zone Controllers (SZC) in response to what the company describes as a "credible external security threat." Progress has temporarily disabled access to affected ShareFile accounts as a precautionary measure while investigating alongside internal and external cybersecurity experts. Although Progress states it has no indication of unauthorised access to customer data at this time, users speculate the threat may relate to two critical vulnerabilities patched in March 2026 — CVE-2026-2699 (CVSS 9.8) and CVE-2026-2701 (CVSS 9.1) — which can be chained for unauthenticated remote code execution. EMEA financial services organisations running on-premises ShareFile Storage Zone Controllers face immediate operational disruption and potential RCE exposure.

2. Regulatory framing

3. Technical analysis & attack chain

Affected component: Progress ShareFile Storage Zone Controller (SZC) — a Windows server component providing private data storage, either on-premises or on a third-party storage system, protected with an application-specific password and self-managed by the customer.

Confirmed facts

1. Progress Software identified a "credible external security threat" targeting ShareFile Storage Zone Controllers.
2. Progress disabled access to ShareFile accounts using Storage Zone Controllers.
3. Progress directed customers to manually shut down the Windows server hosting their Storage Zone Controllers.
4. Progress stated: "At this time, we do not indicate unauthorized access to any Progress ShareFile accounts or customer data."
5. Progress has not disclosed technical details of the threat, specific exploitation methods, or attribution.

Speculated vulnerability link (single-sourced; verify before enforcement)

Users speculate the threat may relate to two vulnerabilities addressed by Progress in March 2026:

• CVE-2026-2699 — CVSS 9.8 (Critical). No verified reference data resolved for this CVE; the CVSS score and severity are taken from the SecurityWeek source only.
• CVE-2026-2701 — CVSS 9.1 (Critical). Same sourcing caveat applies.

Per the source, these flaws could be chained together to:

• Make configuration changes without authentication
• Upload malicious files without authentication
• Achieve remote code execution (RCE)

No CISA-KEV exploitation state has been verified for either CVE. No verified reference data was resolved for this item, so all CVSS scores, severities, and exploitation states cited above are single-sourced from SecurityWeek and should be treated as unconfirmed until corroborated by NVD or vendor advisories.

No IOCs, malware families, C2 infrastructure, threat actor names, or attack telemetry have been disclosed by Progress or observed in the available source material. No named threat actor is identified in any source; no MITRE ATT&CK attribution is available.

Attack chain (reconstructed from source description of the speculated CVEs — unconfirmed)

1. Attacker targets an internet-facing ShareFile Storage Zone Controller.
2. Exploits CVE-2026-2699 (CVSS 9.8) to make unauthorised configuration changes.
3. Exploits CVE-2026-2701 (CVSS 9.1) to upload malicious files without authentication.
4. Chain results in unauthenticated remote code execution on the Windows host.
5. Potential for data access, lateral movement, or persistence on the on-premises network.

This chain is inferred from the source's description of the patched vulnerabilities and has NOT been confirmed by Progress as the active threat vector.

4. Mitigation & containment

P1 — Within 24 hours

1. Immediately shut down all Windows servers hosting ShareFile Storage Zone Controllers. This is the vendor's direct instruction. Do not merely stop the ShareFile service — power off the server.
2. Verify that Progress's server-side access restriction is in effect for your tenant. Confirm with your ShareFile account team that account access has been disabled.
3. Block inbound network traffic to all known SZC host IPs and ports at the perimeter firewall as a defence-in-depth measure, in case any server cannot be immediately shut down.
4. Identify all SZC instances across the estate. Search for the Storage Zone Controller IIS application pool and associated web directories. Typical install path: C:\inetpub\wwwroot\Citrix\ShareFile\StorageZoneController (verify against your environment).
5. Check whether March 2026 patches for CVE-2026-2699 and CVE-2026-2701 were applied. If patching was not completed, treat these servers as presumed-compromised and escalate to incident response.

P2 — Within 72 hours

1. Review IIS logs and Windows Event Logs on all SZC hosts for signs of exploitation: unexpected configuration changes, anomalous file uploads, suspicious application pool recycles, or unexplained process execution (e.g., w3wp.exe spawning child processes).
2. Engage your IR retainer if any SZC host was internet-facing and unpatched as of the March 2026 fix. Prioritise forensic review of C:\inetpub\wwwroot\Citrix\ShareFile\StorageZoneController and associated temp/upload directories.
3. Notify internal stakeholders — CISO, DPO, legal — that a credible external threat exists and the vendor has mandated shutdown. Document the decision rationale for regulatory purposes.
4. Assess whether DORA Art. 19 or NIS2 Art. 23 reporting thresholds are met based on operational impact and potential compromise indicators.

P3 — Within 7 days

1. Monitor Progress communications (vendor forums, customer portals, direct emails) for resolution guidance and patch/fix availability.
2. Do not restart SZC servers until Progress provides explicit confirmation that the threat has been contained and it is safe to bring systems back online.
3. Plan for alternative secure file transfer if business operations require continued file-sharing capability during the outage.
4. When cleared by Progress, apply all available patches before restarting, and validate the SZC configuration for any unauthorised changes made prior to shutdown.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules. No file hashes, distinctive strings, command-line artefacts, registry keys, mutex names, or network indicators have been disclosed by Progress or identified in the available source material.

Recommended behavioural detections (analyst guidance — not rule-based due to absent artefacts)

• Monitor for w3wp.exe (IIS worker process) spawning unexpected child processes on SZC hosts — particularly cmd.exe, powershell.exe, certutil.exe, or msiexec.exe.
• Alert on unexpected file writes to SZC upload/temp directories.
• Alert on unauthorised configuration changes in the ShareFile Storage Zone Controller configuration.
• Review IIS logs for anomalous POST requests to SZC endpoints preceding the shutdown.

7. Sources

• SecurityWeek — "Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns" — https://www.securityweek.com/progress-prompts-sharefile-storage-zone-controller-shutdown-amid-security-concerns/ — 2026-07-13
• The Hacker News — "URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat" — https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html — 2026-07-13
• BleepingComputer — "Progress urges ShareFile customers to shut down servers over 'credible' threat" — https://www.bleepingcomputer.com/news/security/progress-urges-sharefile-customers-to-shut-down-servers-over-credible-threat/ — 2026-07-13

8. Adverse Trace position

Severity: HIGH. A vendor-mandated emergency shutdown of on-premises infrastructure in response to a "credible external security threat" is a significant event. The speculated link to CVE-2026-2699 (CVSS 9.8) and CVE-2026-2701 (CVSS 9.1) — both critical, chainable for unauthenticated RCE — elevates the risk profile substantially, though this link is single-sourced and unconfirmed by Progress. No verified reference data was resolved for this item; all CVSS scores and exploitation states are drawn from a single SecurityWeek report and must be treated with corresponding caution. No IOCs, attribution, or attack telemetry are available. EMEA financial services clients running on-premises ShareFile Storage Zone Controllers should comply with the vendor shutdown directive immediately, verify March 2026 patch status, and prepare for potential DORA Art. 19 / NIS2 Art. 23 incident reporting if compromise indicators are found. Adverse Trace will update this advisory as Progress discloses further detail or as IOCs emerge from the investigation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.