Customer Managed ShareFile Storage Zones Controller

CVE-2026-2699 is an authentication bypass in customer-managed ShareFile Storage Zones Controller (SZC) that lets an unauthenticated remote attacker reach restricted configuration pages. The affected range is ShareFile Storage Zones Controller 5.0.0 through 5.12.3; 5.12.4 fixes it, and the 6.x branch is not affected. This is the on-prem controller product, not ShareFile SaaS itself.

The vendor's CRITICAL 9.8 is fair for the *chain* story but too aggressive for this CVE *by itself*. Real-world risk drops because the exposed population is narrower than a generic internet RCE: it only hits customer-managed 5.x, many enterprises do not expose SZC broadly, and the public watchTowr research shows the headline pre-auth RCE outcome comes from chaining CVE-2026-2699 with CVE-2026-2701, not from CVE-2026-2699 alone.

Why this verdict

• Baseline starts at 9.8, then drops for product scope: this only affects customer-managed ShareFile SZC 5.x. ShareFile SaaS and all 6.x deployments are outside the blast radius.
• Exposure is edge-only, not universal: exploitation requires network reachability to the controller's admin path. Progress documents internet-facing standard zones, but also documents DMZ proxy patterns that materially reduce direct attacker reach.
• This CVE is the opener, not the full finish: the public watchTowr research ties headline pre-auth RCE to CVE-2026-2699 + CVE-2026-2701 together. Scoring CVE-2026-2699 alone like a self-contained one-shot RCE overstates the practical impact.

Why not higher?

I am not calling this CRITICAL because the most damaging public outcome requires a chain, not CVE-2026-2699 in isolation. On top of that, there is no KEV listing and no confirmed exploitation evidence in the reviewed primary sources, which matters for a population-limited on-prem product.

Why not lower?

I am not dropping this to MEDIUM because the bug is still unauthenticated, remote, and edge-relevant on a Windows server that brokers access to enterprise storage. If your org exposes customer-managed SZC externally, this is exactly the sort of foothold that turns into data theft or full host compromise once combined with adjacent weakness or misconfiguration.

1. Restrict admin paths now — Block or allowlist direct access to /ConfigService/Admin.aspx and related configuration endpoints so only trusted management sources or the approved ShareFile path can reach them. For a HIGH verdict, deploy this within 30 days unless your instance is already internet-facing and confirmed vulnerable, in which case do it as the first containment step.
2. Put exposed SZC behind the documented DMZ / proxy model — Progress documents a DMZ proxy pattern specifically to ensure only approved traffic reaches storage zones controllers. If you cannot patch immediately, move public-facing reachability away from the controller itself and enforce the proxy path within 30 days.
3. Hunt for unauthorized config access — Alert on web requests to /ConfigService/Admin.aspx, especially from external IPs, scanners, or addresses outside admin networks. Pair IIS logs with config-drift monitoring so you can spot the auth-bypass stage before it becomes zone takeover or a chained RCE.
4. Constrain the controller's downstream trust — Reduce what the SZC host and service context can reach: SMB shares, storage backends, and outbound internet paths. This will not fix the bypass, but it limits blast radius if the attacker gets config access; make these least-privilege changes within 30 days.

Run this on the Windows host running ShareFile Storage Zones Controller, ideally from an elevated PowerShell prompt so registry access is reliable. Save as check-sharefile-cve-2026-2699.ps1 and run powershell.exe -ExecutionPolicy Bypass -File .\check-sharefile-cve-2026-2699.ps1; it checks installed product versions from standard uninstall registry keys and returns VULNERABLE, PATCHED, or UNKNOWN.

# Requires: Windows PowerShell 5+ or PowerShell 7+

# Purpose: Detect likely exposure to CVE-2026-2699 on ShareFile Storage Zones Controller

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Normalize-Version {
    param([string]$Version)
    if ([string]::IsNullOrWhiteSpace($Version)) { return $null }
    $clean = ($Version -replace '[^0-9\.]', '').Trim('.')
    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
    $parts = $clean.Split('.') | Where-Object { $_ -ne '' }
    while ($parts.Count -lt 4) { $parts += '0' }
    if ($parts.Count -gt 4) { $parts = $parts[0..3] }
    try { return [version]($parts -join '.') } catch { return $null }
}

function Get-ShareFileProducts {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $items = foreach ($path in $paths) {
        Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | Where-Object {
            ($_.DisplayName -match 'ShareFile') -or
            ($_.DisplayName -match 'Storage\s*Zones\s*Controller') -or
            ($_.DisplayName -match 'StorageZones\s*Controller')
        } | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation
    }

    return $items
}

$fixedV5 = Normalize-Version '5.12.4'
$products = Get-ShareFileProducts

if (-not $products -or $products.Count -eq 0) {
    Write-Output 'UNKNOWN - ShareFile Storage Zones Controller not found in uninstall registry keys'
    exit 2
}

$best = $null
foreach ($p in $products) {
    $v = Normalize-Version $p.DisplayVersion
    if ($v) {
        if (-not $best -or $v -gt $best.Version) {
            $best = [pscustomobject]@{
                Name = $p.DisplayName
                RawVersion = $p.DisplayVersion
                Version = $v
                Publisher = $p.Publisher
                InstallLocation = $p.InstallLocation
            }
        }
    }
}

if (-not $best) {
    Write-Output 'UNKNOWN - Matching ShareFile product found, but version could not be parsed'
    exit 2
}

# Logic based on vendor advisory:

# - 5.x versions prior to 5.12.4 are affected

# - 6.x versions are not affected

if ($best.Version.Major -ge 6) {
    Write-Output ("PATCHED - {0} version {1} (6.x branch not affected)" -f $best.Name, $best.RawVersion)
    exit 0
}
elseif ($best.Version.Major -eq 5) {
    if ($best.Version -lt $fixedV5) {
        Write-Output ("VULNERABLE - {0} version {1} is older than 5.12.4" -f $best.Name, $best.RawVersion)
        exit 1
    }
    else {
        Write-Output ("PATCHED - {0} version {1} is at or above 5.12.4" -f $best.Name, $best.RawVersion)
        exit 0
    }
}
else {
    Write-Output ("UNKNOWN - Found {0} version {1}; version family not covered by this detector" -f $best.Name, $best.RawVersion)
    exit 2
}

Sources

1. NVD CVE-2026-2699
2. Progress ShareFile vendor advisory
3. Progress ShareFile architecture overview
4. watchTowr resource summary
5. watchTowr GitHub detection artifact generator
6. runZero asset discovery guidance
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation