FlagThis
← Back to CVE List
Vulnerability Intelligence Report
RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

CVE-2026-2701

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:48.81%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-434 ↗CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-78 ↗CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94 ↗CWE-94: Improper Control of Generation of Code ('Code Injection')

Affected Products & Versions

Vendor Product Affected Versions
Progress ShareFile Storage Zones Controller 0 <= 5.12.3 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
48.810%
GitHub Advisory
GHSA-2vxx-w4h2-4g8g ↗

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityProgress Software Corporation · Vendor · USA
Reserved2026-02-18T17:20:44
Published2026-04-02T13:04:38
Last Updated2026-04-03T03:55:26

Related Intelligence

Related CVEs
CVE-2026-2699 CVSS 9.8 — Customer Managed ShareFile Storage Zones Controller (SZC) allows an un…
CVE-2026-15724 CVSS 8.7 — In Progress ShareFile Storage Zones Controller versions prior to 5.12.…
CVE-2026-16138 CVSS 8.0 — In Progress ShareFile Storage Zones Controller v5.12.5 and below versi…
CVE-2026-93695 CVSS 7.4 — In Progress ShareFile Storage Zones Controller v5.12.6 and below, File…
CVE-2026-16137 CVSS 7.2 — In Progress ShareFile Storage Zones Controller v5.12.5 and below, a pa…
LINK COPIED TO CLIPBOARD