CVE-2026-93694: Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

Q: What access or capabilities does an attacker need to exploit this issue?

The attacker must be able to control copy queue work and successfully win a race condition during queue-item processing. The provided data does not identify a specific required account type or access path for gaining that control.

Q: Which component is affected by the manipulated workflow?

The issue can cause FileCopyService to consume attacker-controlled metadata and content after queue-item acknowledgements are sent to an unvalidated callback URL.

Q: Are newer releases known to be affected?

The affected range is Progress ShareFile Storage Zones Controller version 5.12.6 and below. The provided data does not state which version, if any, contains a fix.

Published Oct 12, 2026

Updated

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

Affected Software

1 affected component

Progress ShareFile Storage Zones Controller<=5.12.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress ShareFile Storage Zones Controller to a version that resolves this vulnerability.
Fixed in v5.12.7

Event History

Oct 12, 2026

CVE Published

via MITRE·12:50 PM

Data Sourced

via MITRE·12:50 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access or capabilities does an attacker need to exploit this issue?

The attacker must be able to control copy queue work and successfully win a race condition during queue-item processing. The provided data does not identify a specific required account type or access path for gaining that control.

Which component is affected by the manipulated workflow?

The issue can cause FileCopyService to consume attacker-controlled metadata and content after queue-item acknowledgements are sent to an unvalidated callback URL.

Are newer releases known to be affected?

The affected range is Progress ShareFile Storage Zones Controller version 5.12.6 and below. The provided data does not state which version, if any, contains a fix.

CVE-2026-93694: Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

Affected Software

Remediation

Event History

Frequently Asked Questions

What access or capabilities does an attacker need to exploit this issue?

Which component is affected by the manipulated workflow?

Are newer releases known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What access or capabilities does an attacker need to exploit this issue?

Which component is affected by the manipulated workflow?

Are newer releases known to be affected?