CVE-2026-16138— Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1210 · Exploitation of Remote ServicesAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress | ShareFile Storage Zones Controller | ≤ 5.12.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16138
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Progress ShareFile Storage Zones Controller 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Progress ShareFile Storage Zones Controller是Progress公司的一款企业级存储区域控制管理软件。 Progress ShareFile Storage Zones Controller 5.12.5及之前版本存在反序列化注入漏洞，该漏洞源于对不可信文件元数据的不安全反序列化，可能导致具有网络共享写权限的用户在Storage Zones Controller主机上执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress | ShareFile Storage Zones Controller | 0 ~ 5.12.5 | - |
II. Public POCs for CVE-2026-16138
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16138
请登录查看更多情报信息。
Same Patch Batch · Progress · 2026-08-17 · 3 CVEs total
| CVE-2026-16139 | 7.2 HIGH | Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller pot |
| CVE-2026-16137 | 7.2 HIGH | Path traversal via unsanitized upload filename leads to arbitrary file write in Progress S |
IV. Related Vulnerabilities
Same product: ShareFile Storage Zones Controller
- CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi - CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil - CVE-2026-15724
Path traversal in Progress ShareFile Storage Zones Controlle - CVE-2026-2701
RCE vulnerability in Progress ShareFile Storage Zones Contro - CVE-2026-2699
EAR vulnerability in Progress ShareFile Storage Zones Contro
Same vendor: Progress
- CVE-2026-16137
Path traversal via unsanitized upload filename leads to arbi - CVE-2026-16139
Arbitrary file write via path traversal in Progress ShareFil - CVE-2026-15968
Stored XSS vulnerability in MOVEit Transfer - CVE-2026-15967
MOVEit Transfer refresh-token processing does not enforce up - CVE-2026-15966
Improper CORS handling in MOVEit Transfer
Same weakness: CWE-502
- CVE-2026-76850
LMDeploy Remote Code Execution via Unsafe Pickle Deserializa - CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru - CVE-2026-76395
Remote Code Execution (RCE) through Deserialization of Untru - CVE-2026-44901
Wazuh Cluster DAPI Protocol Deserialization of Untrusted Dat - CVE-2026-49816
Dell Command Update<5.7.1反序列化致提权漏洞
V. Comments for CVE-2026-16138
No comments yet