Progress patches ShareFile zero-day after shutdown

Progress Software says last week’s emergency shutdown of ShareFile Storage Zone Controllers was caused by a high-severity zero-day and that security fixes are now available.

The company had previously told customers running ShareFile Storage Zone Controllers on Windows servers to shut them down immediately after receiving a warning of a “credible external security threat.” During the investigation, Progress also temporarily disabled access to all ShareFile accounts using Storage Zone Controllers.

Progress told BleepingComputer it moved quickly once it received the alert.

“We acted out of an abundance of caution after we received information from a credible source of a potential threat to the SZC. Our investigation then revealed a vulnerability that we promptly patched before it was publicly known.”

In an update sent to customers, the company said the issue is a path traversal vulnerability affecting all 5.x and 6.x versions of ShareFile Storage Zone Controller. According to the email seen by BleepingComputer, an authenticated administrative user could:

Recommended reading

Why exploit tests aren’t the only way to prove risk

• read arbitrary files accessible to the application’s service account
• write attacker-controlled content to arbitrary directories
• enumerate the server’s filesystem layout

Progress said a CVE identifier has been reserved and will be published in two weeks. The company told BleepingComputer the delay is intentional, giving customers time to patch before technical details become public and potentially useful to threat actors.

The fixes are included in ShareFile Storage Zone Controller 5.12.5 and 6.0.2, and Progress is urging customers to install them as soon as possible. After patching, Storage Zone Controllers can be brought back online.

Progress also said it currently has no indication of unauthorized access to any ShareFile customer account or data and has not identified any active threat, despite the earlier warning.

Storage Zone Controllers are customer-managed Windows servers that let organizations keep files on-premises while still using ShareFile’s cloud platform for authentication, permissions, auditing, and collaboration. Because those servers store transferred files, they are an attractive target for extortion gangs focused on data theft.

BleepingComputer said it asked Progress whether the flaw was found internally or by an outside researcher, and whether more technical details will be released.

The story was updated on 7/14/26 with an additional statement from Progress Software.

×