A combination of two security weaknesses in Progress ShareFile, a platform for secure file sharing in businesses, can be used to steal files from affected systems without needing to log in.

Progress ShareFile is a tool for sharing documents and collaborating, mainly used by medium and large businesses.

These types of platforms are often targeted by ransomware groups, similar to previous data breaches using vulnerabilities in Accellion FTA, SolarWinds Serv-U, Gladinet CentreStack, GoAnywhere MFT, MOVEit Transfer, and Cleo.

Researchers at watchTowr, a cybersecurity firm, found an authentication bypass (CVE-2026-2699) and a way to remotely execute code (CVE-2026-2701) in the Storage Zones Controller (SZC) of Progress ShareFile version 5.x.

SZC allows users to have more control over where their data is stored, whether on their own servers (on-premise or in the cloud) or on Progress’s servers.

After watchTowr notified Progress of the vulnerabilities, they were fixed in Progress ShareFile version 5.12.4, released on March 10.

In a report released today, watchTowr researchers detailed how the attack takes advantage of CVE-2026-2699, which allows unauthorized access to the ShareFile admin panel due to incorrect handling of HTTP redirects.

Once inside, attackers can change Storage Zone settings, including where files are stored and security-related settings like the zone passphrase and other sensitive information.

By exploiting the second vulnerability, CVE-2026-2701, attackers can remotely run code on the server by uploading files and extracting them to place malicious ASPX webshells in the application’s main directory.

The researchers pointed out that to successfully exploit the vulnerability, attackers need to create valid HMAC signatures and extract and decrypt internal secrets. However, this is possible after exploiting CVE-2026-2699 because it allows setting or controlling passphrase values.

According to watchTowr’s scans, there are approximately 30,000 Storage Zone Controller instances exposed to the public internet.

The ShadowServer Foundation is currently tracking 700 publicly accessible Progress ShareFile instances, mostly located in the United States and Europe.

watchTowr discovered the two vulnerabilities and reported them to Progress between February 6 and 13. The full exploit chain was confirmed on February 18 for Progress ShareFile 5.12.4. The vendor released security updates in version 5.12.4, released on March 10.

While there have been no reports of these vulnerabilities being actively exploited, it is crucial to immediately patch systems running vulnerable versions of ShareFile Storage Zone Controller, as the public disclosure of the exploit chain may attract malicious actors.