Read the docs
TI-2026-70937 Aliases CVE-2026-93694GHSA-28j9-4grr-cjxp

Race condition in Progress ShareFile Storage Zones Controller

Priority LOW 17CWE-321Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Progress ShareFile Storage Zones Controller through 5.12.6 sends acknowledgements for queue items to an unvalidated callback URL. Combined with a race condition (CWE-362), this lets a local attacker cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and winning the race.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00072 0th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressShareFile Storage Zones Controllerup to 5.12.6—No fix listedCNA
  • ShareFile Storage Zones Controller VendorProgress Affected up to 5.12.6 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*——Progress
  • cpe:2.3:a:progress:sharefile_storage_zones_controller:*:*:*:*:*:*:*:* Versions — — ·Progress

Remediation

The sources list no fixed version for Progress ShareFile Storage Zones Controller.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress ShareFile Storage Zones Controller — docs.sharefile.com/en-us/sharefile/storage-zones-controller…

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-70938 Arbitrary file write in ShareFile Storage Zones Controller FileCopyServicePriority LOW 34
    • TI-2026-70936 Unauthenticated SSRF in Progress ShareFile Storage Zones ControllerPriority LOW 34
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-93694
  2. 2026-10-12 Alias added: GHSA-28j9-4grr-cjxp
  3. 2026-10-12 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 436 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences