You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)

Sicherheitsmeldung mit Schweregrad hoch. Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Betroffene Kennungen: CVE-2024-50623, CVE-2025-10035, CVE-2026-2699, CVE-2026-2701. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

If you squint and look at the CISA KEV list, you might think it's made up exclusively of vulnerabilities in file transfer solutions.While this would be wrong (and you shouldn’t squint, it’s bad for your eyes), file transfer solutions do play a decent role in the CISA KEV list due to how fondly threat actors, APT groups, and ransomware gangs alike perceive them.The following represent industry-defining historical incidents:The MOVEit breach in 2023,Cleo Harmony, VLTrader and LexiCom in 2024, or,Fortra’s GoAnywhere, with mysterious active exploitation in 2025.Today, we find ourselves analyzing the journey we took to discover multiple vulnerabilities in Progress ShareFile, ultimately chained together to achieve Pre-Authenticated Remote Code Execution - and sharing more memes.What is Progress ShareFile?A software suite that was previously owned by Citrix but later acquired by Progress in 2024.In ShareFile’s own words:ShareFile software gives you a structured, secure space to work with clients - share files, collect signatures, request data, and manage to-dos in one place, improving collaboration and the experience around it.At first glance at the software’s descriptions and signup process, one might assume that ShareFile is a SaaS-based company, which is typically out of our scope. You would be partially right; however, ShareFile maintains an on-premises, extended solution called its “Storage Zone Controller”.The Storage Zone Controller in ShareFile is a customer-managed gateway that keeps your files in your own storage (on-prem or cloud) while still using ShareFile’s SaaS …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2024-50623, CVE-2025-10035, CVE-2026-2699, CVE-2026-2701): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.