CVE-2026-93694

Executive Summary

CVE-2026-93694 is a local, high-complexity vulnerability affecting Progress ShareFile Storage Zones Controller version 5.12.6 and below. During processing of queue items, the software can send acknowledgements to an unvalidated callback URL, which — when combined with a race condition — allows an attacker to cause FileCopyService to consume attacker-controlled metadata and content. The impact is low on confidentiality and availability integrity, with a CVSS base score of 4.0, requiring local access and control over copy queue work to exploit. No public proof-of-concept, exploit code, or CISA KEV listing exists at this time, and no patch has been identified.

Technical Analysis

The core flaw resides in how ShareFile Storage Zones Controller v5.12.6 and below handles acknowledgement callbacks during queue item processing. According to the NVD description, when the service processes queue items, it can dispatch acknowledgements to a callback URL without validating that URL. This unvalidated callback is part of a composite weakness mapped to CWE-321, which is typically associated with hard-coded cryptographic key issues; however, the described behavior (unvalidated redirect/callback combined with a race condition) aligns more closely with a logic flaw in queue processing and callback validation.

The exploitation preconditions are significant:

• The attacker must have control over copy queue work (i.e., the ability to influence what items are enqueued for copying).
• A race condition must be won during queue processing so that FileCopyService consumes attacker-controlled metadata and content rather than legitimate data.

Because acknowledgements are sent to an unvalidated URL, an attacker who can inject or manipulate a queue item can cause the service to "confirm" receipt or processing to an endpoint they control. This confirmation, combined with the race condition, creates a window in which FileCopyService processes metadata and content supplied by the attacker. The result is that the service may operate on attacker-controlled inputs, leading to low integrity impact and low availability impact. Confidentiality is not impacted per the CVSS vector.

The attack is local (AV:L), requires high attack complexity (AC:H) due to the race condition, requires no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), and the resulting impacts are limited to integrity and availability (I:L/A:L).

No technical detail is available regarding the exact code paths, function names, API parameters, or queue item structures beyond what the NVD description provides. The analysis above is strictly limited to the vulnerability class and mechanism as described.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: The attacker identifies a target running ShareFile Storage Zones Controller v5.12.6 or below. Because the attack requires local access, the attacker is likely an insider or an adversary with a foothold on the same host or network segment able to interact with the queue processing service.

2. Triggering the specific flaw: The attacker must gain control over copy queue work. This means injecting or manipulating queue items so that when the queue is processed, the service attempts to send an acknowledgement to a callback URL chosen by the attacker. Because the callback URL is not validated, the acknowledgement is sent to an attacker-controlled endpoint.

3. Payload/execution method at the vulnerability-class level: While the queue item is being processed, the attacker races to supply attacker-controlled metadata and content. If the race is won, FileCopyService consumes the malicious metadata and content instead of legitimate data. The exact payload format and execution mechanism are not specified in the available data.

4. Post-exploitation impact: Successful exploitation allows the attacker to influence Integrity (I:L) and Availability (A:L) of the affected service. The attacker could cause the service to process incorrect files or metadata, potentially disrupting copy operations or causing the service to act on false information. No confidentiality impact and no scope change are expected.

Impact Assessment

The CVSS v3.1 base score is 4.0 (Medium), with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. The attack requires local access, which significantly limits the blast radius to systems where the attacker already has a presence or can interact with the queue processing interface. High attack complexity due to the race condition further reduces the likelihood of successful exploitation. Integrity and availability impacts are low, and there is no confidentiality impact. Business impact is expected to be limited to potential corruption or disruption of file copy operations within the ShareFile Storage Zones Controller environment. No evidence of active exploitation or public exploit code exists, and the vulnerability is not listed in CISA KEV. EPSS is not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Unvalidated Callback Acknowledgement in ShareFile Storage Zones Controller
id: 8f4c2e1a-3b7d-4e9f-a1c2-5d6e7f8a9b0c
status: experimental
description: Detects potential exploitation of CVE-2026-93694 via unvalidated callback URL acknowledgements and FileCopyService race condition
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-93694
author: Threat Intelligence Team
date: 2026/01/01
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID:
            - 1
            - 4688
        Image|endswith:
            - '\FileCopyService.exe'
        CommandLine|contains:
            - 'callback'
            - 'ack'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: medium
tags:
    - attack.t1190
    - cve.2026.93694

YARA Rule

rule CVE_2026_93694_ShareFile_Queue_Callback
{
    meta:
        description = "Detects potential exploitation of CVE-2026-93694 in ShareFile Storage Zones Controller"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93694"
        hash = "unknown"
    strings:
        $a = "FileCopyService" ascii wide nocase
        $b = "callback" ascii wide nocase
        $c = "acknowledgement" ascii wide nocase
        $d = "queue" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        filesize < 50MB and
        (2 of ($a, $b, $c, $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93694 ShareFile Storage Zones Controller Unvalidated Callback Acknowledgement"; flow:established,to_server; content:"POST"; http_method; content:"callback"; http_uri; nocase; content:"ack"; http_header; nocase; reference:cve,2026-93694; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93694; classtype:attempted-admin; sid:100093694; rev:1;)

Elastic Detection

process where event.type == "start" and
process.name == "FileCopyService.exe" and
process.command_line : ("*callback*" or "*ack*" or "*queue*")

Splunk SPL Query

index=windows EventCode=4688 OR EventCode=1
| search (Image="*FileCopyService*" OR CommandLine="*FileCopyService*")
| search (CommandLine="*callback*" OR CommandLine="*ack*" OR CommandLine="*queue*")
| table _time, host, user, Image, CommandLine, ParentImage

Wazuh OSSEC Rule

<group name="sharefile,cve-2026-93694,">
  <rule id="100694" level="10">
    <decoded_as>windows_eventchannel</decoded_as>
    <field name="win.system.eventID">^1$|^4688$</field>
    <field name="win.eventdata.image">FileCopyService.exe</field>
    <field name="win.eventdata.commandLine">callback|ack|queue</field>
    <description>CVE-2026-93694 - Potential ShareFile Storage Zones Controller FileCopyService exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict local access to the ShareFile Storage Zones Controller host and the queue processing interfaces to trusted administrators only.
   • Monitor for unexpected callback URLs or outbound HTTP(S) requests originating from the FileCopyService process.
   • Review and validate all queue item sources; ensure only trusted processes can enqueue copy work.
   • Apply network segmentation to limit lateral movement and reduce the attack surface for local attackers.

2. Patch/upgrade steps:

   • No vendor patch is currently available. Monitor Progress ShareFile security advisories for an updated version beyond 5.12.6.
   • Once a patched version is released, test and deploy promptly. Verify the fix specifically addresses callback URL validation and race condition handling in queue processing.

3. Long-term hardening:

   • Implement strict validation of all callback URLs, including allow-listing approved destinations and rejecting arbitrary URLs.
   • Introduce proper synchronization or locking mechanisms to eliminate race conditions in FileCopyService queue processing.
   • Conduct code reviews focused on unvalidated redirects/callbacks and time-of-check-time-of-use (TOCTOU) race conditions.
   • Enable detailed logging for queue processing and callback dispatch to aid future detection and forensic analysis.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93694
• Progress ShareFile Security Advisories: https://www.progress.com/security
• CWE-321: https://cwe.mitre.org/data/definitions/321.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-93694 not listed as of report date)