{"id":"CVE-2026-2701","published":"2026-04-02T13:04:38Z","modified":"2026-04-03T03:55:26Z","title":"RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)","vendor":"Progress","product":"ShareFile Storage Zones Controller","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress","product":"ShareFile Storage Zones Controller","versions":["<= 5.12.3"]}],"description":{"text":"Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in Progress ShareFile Storage Zones Controller (SZC) allows an authenticated user to upload a malicious file to the server, where it can be executed. An attacker needs network access to the controller and valid user credentials, with no user interaction or special configuration required, and can use this to achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:37Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.54539,"percentile":0.99015,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":11,"pulses":[{"name":"Progress ShareFile Storage Zone Controller Pre-Auth RCE Chain","url":"https://otx.alienvault.com/pulse/6accf9f2815b12f5cf478464","created":"2026-10-12"},{"name":"BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector","url":"https://otx.alienvault.com/pulse/69f33e7bd3afa0cf45245a5c","created":"2026-04-30"},{"name":"BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector - Arctic Wolf","url":"https://otx.alienvault.com/pulse/69f1d32e6b8143fd0e42df04","created":"2026-04-29"},{"name":"Known_Cve | Apr 11, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69d90ecbfe61adc1f3d89b8f","created":"2026-04-10"},{"name":"Known_Cve | Apr 10, 2026","url":"https://otx.alienvault.com/pulse/69d7bd98c6ff9f8a5a310261","created":"2026-04-09"},{"name":"Known_Cve | Apr 9, 2026","url":"https://otx.alienvault.com/pulse/69d66b5f37ba49398ad066dd","created":"2026-04-08"},{"name":"Known_Cve | Apr 8, 2026","url":"https://otx.alienvault.com/pulse/69d51903148f2b12ebc62d05","created":"2026-04-07"},{"name":"Known_Cve | Apr 7, 2026","url":"https://otx.alienvault.com/pulse/69d3c8b63434db28e734c77d","created":"2026-04-06"},{"name":"Known_Cve | Apr 6, 2026","url":"https://otx.alienvault.com/pulse/69d274d73531da3a781cc03e","created":"2026-04-05"},{"name":"Known_Cve | Apr 5, 2026","url":"https://otx.alienvault.com/pulse/69d1156f88bf34624d555f2e","created":"2026-04-04"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-18220","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18220","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-2701","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":28.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9901"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.45,"detail":"11 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}