CVE-2026-93694 Server-side request forgery in ShareFile Storage Zones Controller
Attackers can manipulate copy workflows via unvalidated callback URLs and race conditions, potentially executing code or modifying data in Progress ShareFile Storage Zones Controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93694?
CVE-2026-93694 is a medium-severity server-side request forgery vulnerability in Progress ShareFile Storage Zones Controller, published on 12 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
Which versions are affected by CVE-2026-93694?
How do I fix CVE-2026-93694?
No fix has been published for CVE-2026-93694 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-93694 being exploited?
There is no known exploitation of CVE-2026-93694 in the wild and no public exploit code.
Sources
Also known as GHSA-28j9-4grr-cjxp.