Progress Software has issued an urgent advisory instructing customers running on-premises ShareFile Storage Zone Controllers to immediately power down the servers hosting these components, citing a \u201ccredible external security threat\u201d against the platform.<\/p>\n
The notice, sent directly to customers\u2019 inboxes, states that Progress has no current indication of unauthorized access to ShareFile accounts or data, but is taking the drastic step as a precaution while it works with internal and external cybersecurity experts to assess the threat.<\/p>\n
The email tells administrators that Progress has already disabled account access through Storage Zone Controllers for all affected customers, and separately demands manual shutdown of the underlying servers as a \u201ccritical additional step\u201d to protect data.<\/p>\n
![\"Progress](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgXMQRGEaFBDXHA1kla3zHba69ivBbqFSn3unpn49nbiZXbjaZS6KuvxFrYmB7IBuF2BW7mBDybMPROvVMYI8kgZVvuT48fnvPsjpW3g8pmzjl5lbZixRwkxiOxVUdBeA2b8YMaA2pR47X0Zvnrve0_MeQHoh4zjTLZoac7xeyaSeB7LDfhGjMouT1yZVrd\/s1600\/Progress%2520ShareFile%2520Admins%2520Shut%2520Down%2520Servers1.webp?ssl=1\")
Progress says it expects to share updates within 24 hours and has framed the move as an abundance-of-caution measure rather than confirmation of an active breach.<\/p>\n
The company has not publicly detailed the nature of the threat, leaving open the possibility that it relates to a new zero-day or renewed exploitation attempts against the Storage Zone Controller architecture.<\/p>\n
This is not the first security scare tied to ShareFile\u2019s customer-managed gateway. In April 2026, watchTowr Labs disclosed two chainable vulnerabilities in Storage Zone Controller: CVE-2026-2699, an authentication bypass<\/a> with a CVSS score of 9.8, and CVE-2026-2701, a remote code execution flaw scoring 9.1.<\/p>\n Chained together, the bugs allowed unauthenticated attackers to reach restricted configuration pages and upload malicious ASPX webshells to achieve full remote code execution without credentials.<\/p>\n Shadowserver Foundation identified roughly 784 internet-exposed instances at the time, with the United States and Germany showing the widest exposure, while watchTowr\u2019s broader scan found nearly 30,000 visible instances. Progress patched the flaws in version 5.12.4, and the newer 6.x branch, built on .NET Core, was confirmed unaffected.<\/p>\n Given the platform\u2019s history of critical pre-authentication RCE flaws, security teams should treat this new warning seriously even without technical details, isolating internet-facing Storage Zone Controller instances and monitoring for further guidance from Progress.<\/p>\n Stop Accepting SLAs Written for 2019 SOCs \u2013 Here\u2019s the 2026 AI SLA Vendor<\/strong> Checklist<\/strong> \u2013 Download Free AI SOC SLA <\/strong>Guide<\/a><\/strong><\/p>\n The post Progress Urges ShareFile Admins to Shut Down Servers Over Credible Security Threat<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n