Progress ShareFile Storage Zone Controller authenticated file-upload RCE

CVE-2026-2701 is a critical, authenticated remote code execution flaw in Progress ShareFile Storage Zone Controller — same on-prem 5.x web tier that carries CVE-2026-2699. NVD’s description of the flaw is short: “Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.” The mechanism is a file-upload path that lands writable content in a location the server will execute.

CVSS is 9.1 rather than 9.8 because it requires authentication in isolation. In practice that qualifier does not hold up: watchTowr Labs (WT-2026-0007) demonstrated it chained with CVE-2026-2699 as a pre-auth RCE against on-prem Storage Zone Controllers, so anyone treating this one as “auth-only, deprioritize” was reading the number and not the chain.

Affected and fixed versions

• Affected: Storage Zone Controller 5.x branch, 5.12.3 and earlier
• Fixed: 5.12.4 (released to 5.x customers March 10, 2026)

Exploitation status

Not currently on the CISA Known Exploited Vulnerabilities catalog. watchTowr’s April 2, 2026 disclosure post included a proof-of-concept chain. There is no confirmed mass-exploitation event tied specifically to this pair, but the July 2026 emergency Storage Zone Controller shutdown is a reminder that this product has had multiple critical bugs in the same window — a customer estate that missed the March patch may have been sitting on this chain when unrelated pressure landed.

What to do

1. Verify 5.12.4 or newer is on every Storage Zone Controller you run on the 5.x branch. If you’re on 5.x and below 5.12.4 today, treat it as a compromise-assumed box until proven otherwise.
2. Look at file writes and process spawns on the SZC host between March and now. A file that landed in an executable path with no matching legitimate upload is the finding.
3. If you’re on the 6.x branch, this specific CVE does not apply — but do not skip the July 2026 5.12.5 / 6.0.2 patch, which is a separate authenticated path-traversal issue on the newer builds.
4. Do not rely on “authenticated only” as a mitigation on an internet-exposed managed-file-transfer box. That’s the same reasoning that made MOVEit a mass-compromise event.

Progress’s coordinated disclosure timeline: report from watchTowr February 6, 2026; Progress reproduction confirmed February 18; CVEs assigned February 26; patch to customers March 10; public disclosure April 2. Four weeks from patch to publication is on the shorter end for a managed file-transfer vendor — that only helps customers who actually deployed the patch during it.