# Progress ShareFile RCE chain actively exploited

Published: 2026-04-02 · Severity: high · Sectors: financial-services, healthcare, government-national
Canonical: https://vorant.io/reports/01eec6e5-c9d5-56f2-9005-47da019909b1/progress-sharefile-rce-chain-actively-exploited

> Two Progress ShareFile vulnerabilities (CVE-2026-2699, CVE-2026-2701) can be chained for remote code execution via authentication bypass and webshell deployment; public PoC released by watchTowr.

Progress Software has disclosed multiple vulnerabilities in ShareFile Storage Zones Controller (SZC) that, when chained together, enable unauthenticated remote code execution. CVE-2026-2699 is an authentication bypass stemming from improper HTTP redirect handling, granting access to the ShareFile admin interface. CVE-2026-2701 allows attackers to abuse file upload and extraction functionality to place ASPX webshells in the application webroot. The watchTowr research team has publicly released proof-of-concept code and a demonstration for both vulnerabilities.

Progress ShareFile is a cloud-based content collaboration platform widely used in regulated sectors including finance and healthcare for secure document exchange and workflow management. All versions prior to 5.12.4 are affected. MS-ISAC rates this as high-risk for government and business environments.

Organizations running vulnerable ShareFile instances should apply the 5.12.4 update immediately after testing. Given the public PoC availability and the high-value targets typically using ShareFile in financial and healthcare sectors, exploitation attempts are likely imminent. Network segmentation, vulnerability scanning, and monitoring for ASPX webshell indicators in ShareFile webroots are recommended interim mitigations.

## Mentioned in this report

- Vulnerabilities: CVE-2026-2699 (templated), CVE-2026-2701

## Detection guidance (public sample)

### ASPX Webshell Dropped via ShareFile Storage Zones Controller Upload/Extraction

ATT&CK: T1190

Detects creation of new .aspx files within ShareFile Storage Zones Controller webroot directories, consistent with CVE-2026-2701 file upload/extraction abuse to plant webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ASPX Webshell Dropped via ShareFile Storage Zones Controller Upload/Extraction
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \Citrix\ShareFile\Storage\
    - \ShareFile\StorageCenter\
    - \StorageZonesController\
    TargetFilename|endswith: .aspx
  filter_known:
    TargetFilename|contains:
    - \bin\
    - \App_Themes\
  condition: selection and not filter_known
falsepositives:
- Legitimate application updates or administrator deployment of new ASPX pages during
  patching/upgrade windows
level: high
tags:
- attack.t1190
- attack.persistence
id: 212be88a-bacc-532b-8998-34f5ac3e650f
status: experimental
author: Vorant
```

### IIS Worker Process Spawning Command Shell Following ShareFile Exploitation

ATT&CK: T1190

Detects w3wp.exe (IIS application pool worker, hosting ShareFile SZC) spawning cmd.exe or powershell.exe, indicative of webshell execution after CVE-2026-2699/2701 exploitation chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Command Shell Following ShareFile Exploitation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_signed_admin:
    CommandLine|contains:
    - iisreset
  condition: selection and not filter_signed_admin
falsepositives:
- Scheduled administrative scripts that legitimately invoke shell commands from an
  IIS application pool identity
- Custom ShareFile automation or backup tooling that shells out from the worker process
level: high
tags:
- attack.t1190
- attack.execution
- attack.t1059.001
- attack.t1059.003
id: 8be59173-2c19-5230-b206-dc3215bb04bc
status: experimental
author: Vorant
```

### ShareFile Admin Interface Access Following Suspicious Redirect Pattern

ATT&CK: T1190

Detects HTTP requests reaching ShareFile admin/API endpoints immediately after a redirect response, matching the CVE-2026-2699 authentication-bypass-via-redirect-handling pattern; intended for web/proxy logs where request chains are visible. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ShareFile Admin Interface Access Following Suspicious Redirect Pattern
logsource:
  category: webserver
  product: windows
detection:
  selection:
    cs-uri-stem|contains:
    - /SZC/
    - /StorageCenter/
    - /Admin/
    sc-status:
    - 302
    - 301
  followup:
    cs-uri-stem|contains:
    - /Admin/
    - /StorageCenter/Admin/
    sc-status: 200
  condition: selection and followup
falsepositives:
- Legitimate administrators navigating the ShareFile admin console through normal
  redirect flows
- Load balancer or SSO redirect chains preceding valid authenticated admin sessions
level: medium
tags:
- attack.t1190
- attack.initial_access
id: 8eedf6e1-0d25-53a2-b1aa-e6de24833d85
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-progress-sharefile-could-allow-for-remote-code-execution_2026-030

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/01eec6e5-c9d5-56f2-9005-47da019909b1/progress-sharefile-rce-chain-actively-exploited.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup