CVE-2026-16138
Received Received - Intake

Unsafe Deserialization in Progress ShareFile Storage Zones Controller

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Progress Software Corporation

Description
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-16138
EUVD
EUVD-2026-60197

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
progress sharefile_storage_zones_controller to 5.12.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves unsafe deserialization of untrusted file metadata in Progress ShareFile Storage Zones Controller versions 5.12.5 and below. A user with write access to a Network share can exploit this to execute arbitrary code on the Storage Zones Controller host.

Impact Analysis

An attacker with write access could gain control of the Storage Zones Controller host, potentially leading to unauthorized data access, system compromise, or further network infiltration. This could disrupt services or expose sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Immediately upgrade Progress ShareFile Storage Zones Controller to a version higher than v5.12.5 to address the unsafe deserialization flaw. Restrict write access to Network shares to trusted users only and monitor for unauthorized file modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart