CVE-2026-93693: Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

Q: Who can exploit this issue?

A remote attacker does not need authentication or user interaction. Exploitation requires network access to a vulnerable Progress ShareFile Storage Zones Controller instance.

Q: What can an attacker do if exploitation succeeds?

An attacker can chain the outbound-request validation, JSONP formatting, and queue-service validation weaknesses to make server-side requests to unintended local handlers and perform unauthorized queue operations. The stated impact is limited to integrity and availability; no confidentiality impact is identified.

Q: Which versions are affected?

Progress ShareFile Storage Zones Controller version 5.12.6 and earlier are affected.

Published Oct 12, 2026

Updated

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

Affected Software

1 affected component

Progress ShareFile Storage Zones Controller<=5.12.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress ShareFile Storage Zones Controller to a version that resolves this vulnerability.
Fixed in v5.12.7

Event History

Oct 12, 2026

CVE Published

via MITRE·12:48 PM

Data Sourced

via MITRE·12:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker does not need authentication or user interaction. Exploitation requires network access to a vulnerable Progress ShareFile Storage Zones Controller instance.

What can an attacker do if exploitation succeeds?

An attacker can chain the outbound-request validation, JSONP formatting, and queue-service validation weaknesses to make server-side requests to unintended local handlers and perform unauthorized queue operations. The stated impact is limited to integrity and availability; no confidentiality impact is identified.

Which versions are affected?

Progress ShareFile Storage Zones Controller version 5.12.6 and earlier are affected.

CVE-2026-93693: Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do if exploitation succeeds?

Which versions are affected?