Bottom line: Progress Software warns of a targeted security threat against ShareFile Storage Zone Controller and demands immediate manual shutdown of affected servers.
Progress Software has urged administrators to immediately shut down their local ShareFile Storage Zone Controllers to contain an active external security threat. The company has temporarily disabled affected accounts server-side.
Progress Software has notified licensees that an external security threat exists that specifically targets ShareFile Storage Zone Controllers. The company has ordered immediate manual shutdown of the servers on which these controllers are hosted. The affected accounts have been temporarily disabled server-side since July 10, 2026. According to Progress, there is currently no evidence of unauthorized access to customer data.
Storage Zone Controllers are a critical component in ShareFile infrastructure: they enable organizations to store data locally rather than in the cloud and are responsible for data transfer between cloud and local storage. Since this component is typically directly accessible via the Internet, it represents a potential attack vector. Cloud-based accounts without a local storage component are not affected by the current threat. The Shadowserver Foundation identified several hundred publicly accessible instances worldwide through network scans: 115 in the United States, 47 in Germany, and 17 in the Netherlands.
This is not the first critical security issue at Progress Software. In February 2026, the company had to patch two critical vulnerabilities in its customer-managed controllers. The more severe flaw had a CVSS score of 9.8 and allowed unauthenticated attackers to access configuration pages and execute code remotely. Following disclosure of these flaws, the Shadowserver Foundation began monitoring these systems. Progress Software came into focus from cyberattacks in 2023 when the ransomware group Cl0p exploited a vulnerability in the file transfer software MOVEit for global attacks.
Source: www.it-daily.net · Published July 13, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.3.