CVE-2026-2701 RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)
Authenticated attackers can upload malicious files to Progress ShareFile Storage Zones Controller to achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2701?
CVE-2026-2701 is a critical vulnerability in Progress ShareFile Storage Zones Controller, published on 2 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.
Which versions are affected by CVE-2026-2701?
It affects 1 product.
Products include Progress Sharefile Storage Zones Controller.
How do I fix CVE-2026-2701?
No fix has been published for CVE-2026-2701 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2701 being exploited?
There is no known exploitation of CVE-2026-2701 in the wild and no public exploit code.
Other vulnerabilities in Progress ShareFile Storage Zones Controller
- CVE-2026-2699 EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-15724 Path traversal in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-16138 Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
- CVE-2026-16137 Path traversal in ShareFile Storage Zones Controller
- CVE-2026-16139 Path traversal in ShareFile Storage Zones Controller
Sources
Also known as GHSA-2vxx-w4h2-4g8g.