CVE-2026-93693

MEDIUM 6.5

Published 2026-10-12 · Last modified 2026-10-12

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 15th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.5CVSS 3.1 · MEDIUM

ConfidentialityNone
IntegrityLow
AvailabilityLow

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

Vendors Progress

Products Sharefile Storage Zones Controller

Weakness (CWE)

CWE-918: : Server-Side Request Forgery (SSRF)
CWE-20: : Improper Input Validation
CWE-116: : Improper Encoding or Escaping of Output
CWE-306: : Missing Authentication for Critical Function

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References and research data (JSON)

All CVSS metrics

MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Advisories

https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26 vendor-advisoryCVE record · ProgressSoftware · Updated 2026-10-12T12:48:53.652Z
NVD · CVE-2026-93693 · Updated 2026-10-15T16:08:54.067
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97365 ADVISORYEUVD · EUVD-2026-97365

Sources: NVD · CVE.org · EPSS