{"api_version":"1","generated_at":"2026-10-21T19:44:20+00:00","cve":"CVE-2026-93694","urls":{"html":"https://cve.report/CVE-2026-93694","api":"https://cve.report/api/cve/CVE-2026-93694.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-93694","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-93694"},"summary":{"title":"Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-10-12 13:17:33","updated_at":"2026-10-15 16:08:54"},"problem_types":["CWE-321","CWE-362","CWE-918","CWE-918 CWE-918: Server-Side Request Forgery (SSRF)","CWE-321 CWE-321: Use of Hard-coded Cryptographic Key","CWE-362 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","data":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26","name":"https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93694","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93694","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress","product":"ShareFile Storage Zones Controller","version":"affected 5.12.6 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to ShareFile Storage Zones Controller v5.12.7 or later.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-93694","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-12T13:53:37.213575Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-12T14:43:50.913Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"ShareFile Storage Zones Controller","vendor":"Progress","versions":[{"lessThanOrEqual":"5.12.6","status":"affected","version":"0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition."}],"value":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition."}],"impacts":[{"descriptions":[{"lang":"en","value":"An attacker able to manipulate FileCopyService queue work can redirect trusted worker requests, provide forged upload acknowledgements, and cause inconsistent copy metadata to be consumed, compromising the confidentiality, integrity, and availability of the copy workflow."}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"},{"cweId":"CWE-321","description":"CWE-321: Use of Hard-coded Cryptographic Key","lang":"en","type":"CWE"},{"cweId":"CWE-362","description":"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-12T12:50:22.621Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><div>Upgrade to ShareFile Storage Zones Controller v5.12.7 or later.</div></div>"}],"value":"Upgrade to ShareFile Storage Zones Controller v5.12.7 or later."}],"source":{"discovery":"EXTERNAL"},"title":"Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller","x_generator":{"engine":"Manual CVE 5.1 draft"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-93694","datePublished":"2026-10-12T12:50:22.621Z","dateReserved":"2026-09-18T14:49:09.639Z","dateUpdated":"2026-10-12T14:43:50.913Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-12 13:17:33","lastModifiedDate":"2026-10-15 16:08:54","problem_types":["CWE-321","CWE-362","CWE-918","CWE-918 CWE-918: Server-Side Request Forgery (SSRF)","CWE-321 CWE-321: Use of Hard-coded Cryptographic Key","CWE-362 CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.4,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-12T13:53:37.213575Z","id":"CVE-2026-93694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93694","Ordinal":"1","Title":"Untrusted request routing and forged acknowledgements permit cop","CVE":"CVE-2026-93694","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93694","Ordinal":"1","NoteData":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.","Type":"Description","Title":"Untrusted request routing and forged acknowledgements permit cop"}]}}}