CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass

Critical Authentication Bypass (CVSS 9.8) in customer-managed Progress ShareFile Storage Zones Controller (SZC) ≤ 5.12.3.

📋 Overview

CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web interface of Progress ShareFile Storage Zones Controller (customer-managed deployments).

An unauthenticated remote attacker can access restricted configuration pages, which can lead to system configuration changes and, when chained with CVE-2026-2701, full pre-auth remote code execution (RCE).

• Affected Product: Progress ShareFile Storage Zones Controller (SZC) 5.x (up to 5.12.3)
• Not Affected: ShareFile 6.x and cloud-hosted instances
• Fixed In: Storage Zones Controller 5.12.4 (released March 2026)

This repository contains detection scripts, technical analysis, and proof-of-concept materials (where legally and ethically permitted).

🎯 Vulnerability Details

• CVE ID: CVE-2026-2699
• Severity: Critical (CVSS v3.1 Base Score: 9.8)
• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Type: Authentication Bypass / Improper Access Control (CWE-284) with Execution After Redirect (EAR)
• Impact: Unauthenticated access to administrative configuration endpoints → potential full system compromise when chained

Root Cause

The vulnerability stems from insufficient access control and flawed redirect handling in the SZC web management interface, allowing unauthenticated users to reach sensitive configuration functionality.

🛠️ Repository Contents

• detection/ — Non-destructive detection scripts (Python)
• analysis/ — Detailed technical write-up and root cause explanation
• poc/ — Proof-of-concept (educational / authorized testing only)
• exploit-chain/ — Demonstration of chaining with CVE-2026-2701 (RCE)
• assets/ — Screenshots, diagrams, and logs

🚨 Affected Versions

Note: Only customer-managed (on-premises) Storage Zones Controller deployments are impacted.

✅ Remediation

1. Upgrade immediately to Storage Zones Controller 5.12.4 or later.
2. Restrict public internet exposure of SZC management interfaces (use VPN, firewall rules, or zero-trust access).
3. Monitor logs for suspicious access to /Configuration/ or similar endpoints.
4. Apply the official security patch from Progress Software.

Official Advisory:
Progress ShareFile Security Vulnerability – February 2026

🔍 Detection

This repository includes a lightweight detection script:

python3 watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py -t https://target-sz-controller.example.com

Inspired by the official watchTowr detection artifact.

📚 References

• NVD Detail — CVE-2026-2699
• watchTowr Labs Full Analysis
• Progress Official Advisory
• Tenable CVE Page
• GitHub Advisory: GHSA-ppf9-6x38-42wv

⚠️ Legal & Ethical Notice

All materials in this repository are provided for educational, research, and defensive security purposes only.

Unauthorized exploitation against systems you do not own or have explicit permission to test is illegal and unethical.

⭐ Star History & Contributions

Contributions, improved detections, or additional write-ups are welcome via Pull Requests.

Made with ❤️ for the security community