You're not viewing the latest version of the documentation, do you want to switch?

Security vulnerability fix for ShareFile Storage Zones Controller 5.x (September 2026)

Overview

High Severity Vulnerabilities – September 2026  – CVE-2026-93693, CVE-2026-93694 and CVE-2026-93695

The Progress ShareFile team recently confirmed high severity security vulnerabilities in ShareFile Storage Zones Controller v5 deployments for customer managed zones.

These vulnerabilities when chained together allow an unauthenticated remote attacker to reach an exposed but currently unused connector SSO endpoint, induce Storage Zones Controller to make requests to internal services, create unauthorized copy jobs, and write attacker-controlled content to arbitrary locations writable by the service account. Writing executable content to an IIS-served directory could enable remote code execution.

Issues

CVE-2026-93693: Unauthenticated queue manipulation through connector SSRF and response injection.

CVE-2026-93694: Untrusted request routing and forged acknowledgements permit copy-workflow manipulation.

CVE-2026-93695: Arbitrary file write through remote file identifiers.

Solution

We have addressed the vulnerabilities in v5 latest version. We strongly recommend that customers upgrade to the latest v5 patch version v5.12.7. Alternatively,customers can upgrade to the latest v6 version, which is not affected by these vulnerabilities.

For questions or assistance, contact ShareFile Support.