CVE-2026-2699

Progress Software Urges Businesses to Immediately Shut Down ShareFile Storage Zone Controller Servers Over Credible External Threat

Progress Software has instructed customers to manually power down servers running ShareFile Storage Zone Controller due to a credible external threat, temporarily blocking affected accounts while an investigation is underway. The company has not disclosed the nature of the threat or any timeline for restoring access, and no evidence of unauthorized access to customer data has been found so far. Storage Zone Controller enables organizations to store and manage data in their own infrastructure or with third-party providers instead of relying solely on Progress-hosted services. Some users have speculated that the incident may be linked to two high-severity vulnerabilities patched in March, CVE-2026-2699 and CVE-2026-2701, which could allow unauthenticated attackers to modify controller settings, upload malicious files, and execute arbitrary commands. Progress Software is treating the server shutdown as an additional protective measure while the investigation continues, highlighting the seriousness with which the company views the potential risk.