ShareFile Storage Zones Controller 5.12.7 fixes a chain to code execution

ShareFile Storage Zones Controller 5.12.7 fixes a chain to code execution

13 October 2026: Progress has fixed three high severity flaws in ShareFile Storage Zones Controller 5, CVE-2026-93693, CVE-2026-93694 and CVE-2026-93695, which chained together let an unauthenticated remote attacker write files anywhere the service account can write and, on an IIS-served directory, run code on the server. The fix is version 5.12.7; version 6 is not affected.

Not yet independently verified. Progress dates its advisory only to September 2026 and gives no CVSS scores. Neither Progress nor CSIRT Italia reports exploitation so far. We will update this when it can be confirmed, and remove this note.

Only customer-managed storage zones are in scope. Those are the deployments where an organisation keeps ShareFile data on its own servers or storage, usually for data residency or contract reasons, and runs the controller itself.

How the three flaws chain

Progress describes the attack as starting at a connector single sign-on endpoint that is exposed but not in use. From there the controller can be induced to make requests to internal services (CVE-2026-93693, queue manipulation through server-side request forgery and response injection), to accept forged acknowledgements that create unauthorised copy jobs (CVE-2026-93694), and finally to write attacker-controlled content to arbitrary locations through remote file identifiers (CVE-2026-93695). Writing executable content into a directory IIS serves is what turns the file write into remote code execution.

None of the three needs a login. That matters more than the "high" rating suggests, because a storage zones controller is normally published to the internet so that the ShareFile service and remote users can reach it.

Which versions are fixed

• Storage Zones Controller 5.x before 5.12.7: affected
• Storage Zones Controller 5.12.7: fixed
• Storage Zones Controller 6.x: not affected, according to Progress

Italy's national cybersecurity agency published an alert on the flaws on 13 October. It lists versions before 5.12.7 as affected, singles out CVE-2026-93695 as the high severity issue that can lead to code execution under certain conditions, and records no known proof of concept or exploitation. It rates the systemic impact as medium.

What to check on a controller

The quickest check is the controller version. An organisation that cannot upgrade at once has one lead from the advisory itself: the chain begins at an unused connector SSO endpoint, so that path is the place to restrict at the reverse proxy and to look for in request logs. Unexpected copy jobs in the controller's queue and new files in IIS-served folders are the traces the later steps would leave.

Moving to version 6 is the other route Progress offers. It is a larger change than a patch release, so most customers on 5.x will take 5.12.7 now and plan the move separately.

ShareFile in our catalogue

Our file sharing software category lists 13 products, including ShareFile under its earlier Citrix name and Nextcloud, the self-hosted option buyers most often compare it with when data has to stay on their own servers.

Related on TrustList:

• Rejetto HFS session-forgery flaw CVE-2026-61500 now targeted by attackers: upgrade to 3.2.1 or later

Sources

• Progress ShareFile: Security vulnerability fix for ShareFile Storage Zones Controller 5.x (dated September 2026, read 13 October 2026), 13 October 2026
• Agenzia per la cybersicurezza nazionale (CSIRT Italia): alert AL01/261013/CSIRT-ITA, 13 October 2026