Remote Code Execution Vulnerability in Progress ShareFile Storage Zones Controller
CVE-2026-93695

7.4HIGH

Key Information:

Vendor

Progress

Status
Sharefile Storage Zones Controller
Vendor
CVE Published:
12 October 2026

What is CVE-2026-93695?

The ShareFile Storage Zones Controller versions up to 5.12.6 contain a vulnerability where the FileCopyService improperly constructs local temporary file paths using remote file identifiers. This inadequacy allows attackers to manipulate file paths, potentially enabling them to write malicious content to locations on the filesystem that are writable by the service account. If successful, this can lead to remote code execution, especially in scenarios where directories served by IIS are writable, thereby compromising the integrity of the system.

Affected Version(s)

ShareFile Storage Zones Controller 0 <= 5.12.6

References

https://docs.sharefile.com/en-us/sharefile/storage-zones-...
vendor-advisory

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.