New Progress ShareFile Flaws Expose Servers to Unauthorized Remote Takeover

WatchTowr Labs disclosed two critical vulnerabilities in the on-premises Progress ShareFile Storage Zone Controller (Branch 5.x) — an authentication bypass (CVE-2026-2699) caused by an "Execution After Redirect" coding error and a follow-on RCE (CVE-2026-2701) that allows attackers to reconfigure the storage location to the webroot and upload an ASPX web shell. Roughly 30,000 instances are exposed publicly; Progress released fixes in version 5.12.4 on March 10, 2026, and organizations are urged to patch immediately and monitor webroots and configuration endpoints for suspicious activity.