CVE-2026-2699

What it actually does

The flaw is an authorization bypass in Progress ShareFile Storage Zones Controller that allows a network-accessible, unauthenticated attacker to reach configuration pages that should be restricted to administrators. Once those pages are reachable, the attacker may be able to alter Storage Zones Controller settings, security-related configuration, storage integration settings, or other application parameters. Because the vulnerable component runs as a server-side application, unsafe configuration changes can potentially lead to remote code execution with the privileges of the ShareFile/IIS application or related service account.

Why it matters to the business

A successful attack could let an external attacker take control of a ShareFile Storage Zones Controller, disrupt file-sharing operations, expose or alter stored files, change storage or authentication behavior, and potentially use the server as a foothold into the Windows/IIS environment. The CVSS score is critical, exploitation is reported as weaponized, and EPSS is high, so internet-exposed deployments should be treated as urgent even though the issue is not currently listed in CISA KEV and is not marked as ransomware-associated.

How an attack unfolds

An attacker first identifies a publicly reachable ShareFile Storage Zones Controller. They then send unauthenticated HTTP requests to configuration functionality that should normally require administrative access. If the controller is vulnerable, the application serves restricted configuration pages or accepts configuration changes without requiring valid credentials. The attacker can then modify sensitive settings, redirect integrations, weaken protections, or introduce malicious configuration values. Depending on which settings are exposed and how the controller processes them, those changes may enable server-side command execution, code loading, persistence through modified configuration, data access, or service disruption. After gaining execution or durable administrative influence, the attacker may harvest secrets, inspect files handled by the storage zone, move laterally from the Windows host, or erase evidence.

How to fix it

Apply the vendor-provided security update or upgrade to the latest fixed Progress ShareFile Storage Zones Controller release as soon as an official fixed version is available. No exact fixed version was provided in the input, so administrators should verify current remediation guidance directly from Progress/ShareFile advisories. Until patched, remove Storage Zones Controller administrative and configuration interfaces from direct internet exposure, restrict access to trusted management networks or VPNs, enforce IP allowlisting at a reverse proxy/firewall/WAF, and block unauthenticated access to configuration-related paths. Review and harden IIS authentication and authorization rules, ensure least privilege for the application pool and service accounts, rotate secrets that may be present in controller configuration, and validate that storage connectors and authentication integrations have not been changed.

How to confirm the fix worked

Confirm the installed Storage Zones Controller version against the vendor advisory and verify that it is at or above the fixed release once available. From an unauthenticated network location, request known configuration/admin pages and confirm the response is 401, 403, or a login redirect rather than a configuration page or successful configuration action. Review IIS and application authorization rules to ensure configuration paths require authentication and administrative authorization. Compare current controller configuration against a known-good baseline, including storage locations, connector settings, keys, authentication settings, proxy settings, and service account configuration. Perform an external exposure scan to confirm configuration endpoints are not reachable from the public internet.

Typical attack path

1. Discover an internet-facing Progress ShareFile Storage Zones Controller instance.
2. Probe restricted configuration URLs without authenticating.
3. Confirm the server improperly exposes or accepts changes to configuration pages.
4. Modify sensitive Storage Zones Controller settings or upload/submit malicious configuration values.
5. Trigger the changed configuration through normal application behavior or service reloads.
6. Obtain remote code execution, unauthorized data access, or administrative control of the controller.
7. Establish persistence, collect secrets or files, and pivot to adjacent Windows/IIS infrastructure.

How to detect it

Investigate IIS access logs, reverse proxy logs, WAF logs, Windows Security logs, application event logs, Storage Zones Controller logs, Sysmon/EDR telemetry, and file integrity monitoring for signs of unauthorized configuration access or follow-on execution. Look for unauthenticated requests to configuration or administrative paths, especially from internet IPs, requests that return HTTP 200/302 where authentication should be required, POST requests to configuration endpoints, and unusual user-agent strings or scanning patterns. Review timestamps of configuration files and registry/application settings for changes that do not match authorized maintenance windows. On the Windows host, search for suspicious child processes spawned by IIS worker processes, such as command shells, PowerShell, script interpreters, download utilities, archiving tools, or credential-dumping utilities. Also check for newly created files in the web root, unexpected ASPX files, modified web.config files, new scheduled tasks, new local users, abnormal outbound connections, and changes to storage connector or authentication settings. If threat-hunting windows are needed, include activity from the 2026-04-02 publication date onward and prioritize the most recent 130 days because exploitation is reported as weaponized.

• GET /configservice/
• POST /configservice/
• GET /ConfigService/
• POST /ConfigService/
• GET /configuration
• POST /configuration
• GET /admin
• POST /admin
• C:\inetpub\wwwroot\Citrix\StorageCenter\web.config
• C:\inetpub\wwwroot\Citrix\StorageCenter\*.aspx
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe

What your security team should do

• Prioritize remediation for any internet-facing ShareFile Storage Zones Controller because the issue is critical, unauthenticated, network-exploitable, and reported as weaponized.
• Immediately restrict access to configuration and administrative interfaces to trusted management networks while patch status is confirmed.
• Inventory all Storage Zones Controller instances, including disaster recovery, staging, and legacy deployments.
• Review IIS, reverse proxy, WAF, and firewall logs for unauthenticated access attempts to configuration-related paths since at least the publication date.
• Compare current Storage Zones Controller configuration to a known-good baseline and investigate any unexplained changes.
• Rotate secrets, API keys, storage credentials, certificates, and service account passwords that may be stored or referenced by the controller if compromise is suspected.
• Harden the Windows host and IIS application pool with least privilege, egress restrictions, endpoint detection, and command-execution monitoring.
• Monitor vendor advisories for fixed versions and apply the patch immediately when available.