New Progress ShareFile Flaws Expose Servers to Unauthorized Remote Takeover
Security researchers at watchTowr Labs have disclosed a critical exploit chain in the Progress ShareFile Storage Zone Controller.
The vulnerabilities, tracked as CVE-2026-2699 and CVE-2026-2701, enable unauthenticated attackers to achieve Remote Code Execution (RCE) and completely compromise vulnerable servers.
With roughly 30,000 instances exposed to the public internet, organizations are urged to patch immediately to prevent catastrophic data breaches.
Managed file transfer (MFT) solutions remain a top target for advanced persistent threat (APT) groups and ransomware syndicates.
Following historic breaches involving tools like MOVEit, Cleo Harmony, and GoAnywhere, threat actors continuously hunt for unpatched data-sharing gateways.
See more here 👋
