In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HProgress Sharefile Storage Zones Controller
APPProgress< 5.12.6
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDeserialization
CWE
Related vulnerabilities
CVE-2026-2699CRITICAL9.8PL ✓same product
Auth Bypass i RCE w Progress ShareFile Storage Zones Controller
CVE-2026-2701CRITICAL9.1PL ✓same product
RCE w Progress Sharefile Storage Zones Controller — upload złośliwego pliku
CVE-2026-16137HIGH7.2same product
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perf...
CVE-2026-16139HIGH7.2same product
In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administ...
CVE-2026-15724HIGH8.7PL ✓same product
Path traversal w Progress ShareFile Storage Zones Controller