Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-93694— Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

Quick assessment

Affected

Progress ShareFile Storage Zones Controller

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Progress ShareFile Storage Zones Controller 5.12.6 及更早版本中，队列项的处理可能会向未经验证的回调 URL 发送确认消息。结合竞态条件，攻击者可能导致 FileCopyService 处理由攻击者控制的数据和元数据。此漏洞利用需要攻击者对复制队列作业的控制权以及触发竞态条件。

CVSS 4.0 · Medium EPSS 0.07% · P0 Updated Oct 12, 2026

Possible ATT&CK Techniques 2 AI

T1195 · Supply Chain Compromise T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Progress	ShareFile Storage Zones Controller	`≤ 5.12.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

Source: CVE Program / CVE List V5

Vulnerability Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Progress	ShareFile Storage Zones Controller	0 ~ 5.12.6	-

II. Public POCs for CVE-2026-93694

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93694

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-93694 (1)

🔗 Security Vulnerability Fix (September 2026) vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-93694

Same Patch Batch · Progress · 2026-10-12 · 3 CVEs total

CVE-2026-93695	7.4 HIGH	Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones C
CVE-2026-93693	6.5 MEDIUM	Unauthenticated queue manipulation through connector SSRF and response injection in Progre

IV. Related Vulnerabilities

Same product: ShareFile Storage Zones Controller

Same vendor: Progress

Same weakness: CWE-918

V. Comments for CVE-2026-93694

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-93694— Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-93694

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-93694

III. Intelligence Information for CVE-2026-93694

Vendor Advisories for CVE-2026-93694 (1)

Same Patch Batch · Progress · 2026-10-12 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-93694

Leave a comment