CVE-2026-93693
Received Received - Intake

Improper Input Validation in Progress ShareFile Storage Zones Controller

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-93693
EUVD
EUVD-2026-97365

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress ShareFile Storage Zones Controller 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Progress ShareFile Storage Zones Controller v5.12.6 and below involves three flaws that can be chained by a remote unauthenticated attacker. It allows improper validation of outbound requests, unsafe JSONP responses, and insufficient queue service checks. The attacker can issue server-side requests to unintended local handlers and perform unauthorized queue operations.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized queue operations, unusual outbound requests, or unexpected file writes. Monitor logs for SSRF attempts, JSONP response anomalies, or queue service interactions. Review network traffic for connections to unintended local handlers. Use tools like netstat, Wireshark, or SIEM queries to identify suspicious activity.

Impact Analysis

An attacker could exploit this to manipulate internal service requests, create unauthorized copy jobs, and write attacker-controlled content to locations accessible by the service account. If executable content is written to an IIS-served directory, it could lead to remote code execution.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Unauthorized queue operations or file writes may expose sensitive data, triggering compliance violations if exploited.

Mitigation Strategies

Immediately upgrade to ShareFile Storage Zones Controller v5.12.7 or later. If using v5, apply the latest patch. Alternatively, upgrade to v6 which is unaffected. Disable unused connector SSO endpoints and restrict access to queue services. Review and remove any executable content in IIS-served directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart