---
id: CVE-2026-93694
title: >-
  In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing
  of queue items can send acknowledgements to an unvalidated callback URL, this
  behavior together with a race condition allows the attacker to cause
  FileCopyServi…
summary: >-
  In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing
  of queue items can send acknowledgements to an unvalidated callback URL, this
  behavior together with a race condition allows the attacker to cause
  FileCopyServi…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-321
  - CWE-362
  - CWE-918
vendor: Progress
product: ShareFile Storage Zones Controller
affected:
  - sharefile_storage_zones_controller <= 5.12.6
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:08:54.067'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93694'
references:
  - url: >-
      https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26
    label: security@progress.com
tags:
  - nvd
  - cve.org
epss: 0.00072
epssPercentile: 0.00051
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-12T13:53:37.213575Z'
ingestedAt: '2026-10-12T14:50:34.116Z'
---

## Overview

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.