Critical Vulnerabilities CVE-2026-2699 and CVE-2026-2701 in Progress ShareFile

Overview of CVE-2026-2699 and CVE-2026-2701

On April 2, 2026, cybersecurity firm watchTowr publicly disclosed proof-of-concept exploits for two critical vulnerabilities in Progress ShareFile, identified as CVE-2026-2699 and CVE-2026-2701. When exploited together, these vulnerabilities allow unauthenticated attackers to bypass authentication mechanisms and achieve remote code execution (RCE) on affected systems.

Technical Details

While specific technical details of CVE-2026-2699 and CVE-2026-2701 have not been fully disclosed, the combination of these vulnerabilities enables attackers to:

• Bypass authentication controls, granting unauthorized access to the system.
• Execute arbitrary code remotely, potentially leading to full system compromise.

Given that ShareFile is widely used for managing and storing sensitive enterprise data, these vulnerabilities pose a significant risk to organizations relying on this platform.

Impact and Exploitation

As of the disclosure date, there have been no confirmed reports of these vulnerabilities being exploited in the wild. However, the public release of exploit code by watchTowr increases the likelihood of imminent exploitation attempts. Organizations using ShareFile are strongly advised to apply the necessary patches without delay to mitigate potential risks.

Mitigation and Recommendations

Progress Software has released patches to address these vulnerabilities. Affected customers using versions in the 5.x branch should upgrade to version 5.12.4 or migrate to supported 6.x releases. Technical support is available for customers under active warranty and maintenance agreements.

To detect potential exploitation attempts, organizations should monitor for the following indicators:

• Suspicious access attempts to /ConfigService/Admin.aspx, particularly requests resulting in HTTP 302 responses with unusually large response bodies.
• Unauthorized or unexpected changes to ShareFile Storage Zone configurations, which may indicate post-exploitation activities.
• Presence of unexpected .aspx files in webroot directories such as c:\inetpub\wwwroot\ShareFile\StorageCenter\, which could signify web shell deployments.

Organizations are encouraged to implement these patches promptly and remain vigilant for any signs of exploitation to protect their systems and sensitive data.

Conclusion

The disclosure of CVE-2026-2699 and CVE-2026-2701 underscores the critical importance of timely vulnerability management and patching. Organizations utilizing Progress ShareFile must act swiftly to apply the recommended updates and monitor their systems for any indicators of compromise to safeguard against potential attacks.

For more detailed information, refer to the advisory from Beazley Security: Critical Vulnerabilities in Progress ShareFile (CVE-2026-2699, CVE-2026-2701).