Thought Leadership
Progress Software is warning customers of an active security threat targeting ShareFile Storage Zone Controllers and is urging administrators to manually shut down affected on-premises servers immediately.
Progress Software has instructed administrators to immediately power down their on-premises ShareFile Storage Zone Controller servers in response to what it describes as a credible external security threat specifically targeting this software component.
As an initial mitigation measure, the company has already temporarily disabled affected accounts on the server side. According to Progress’ official status page, systems using the impacted controllers have been unavailable since July 10, 2026.
In a notification sent to customers, the company stated:
“We have reason to believe there is a credible external security threat targeting Progress Software ShareFile Storage Zone Controllers.” The notice further emphasized the urgency of the situation: “IMMEDIATE ACTION REQUIRED: You must manually shut down the server hosting your Storage Zone Controller. This is a critical additional step to help ensure the security of your data.”
Progress Software
Exposure Risk and Impact in Germany
ShareFile is a platform for secure file sharing and document management. Its Storage Zone Controller enables organizations to store files on their own on-premises infrastructure instead of using cloud storage. Because the controller manages data transfers between cloud services and local storage, it is typically internet-facing, making it an attractive target for attackers. Cloud-only ShareFile environments that do not use on-premises Storage Zone Controllers are not affected by the current security issue.
Progress Software says it has no evidence of unauthorized access to customer data at this time.
Internet scans conducted by the Shadowserver Foundation identified several hundred publicly accessible Storage Zone Controller instances worldwide. The organization found 115 exposed systems in the United States, 47 in Germany, and 17 in the Netherlands.
History of Critical Progress Vulnerabilities
Earlier this year, in February, Progress Software addressed two critical vulnerabilities affecting customer-managed Storage Zone Controllers. The most severe flaw received a CVSS score of 9.8 out of 10, allowing unauthenticated attackers to access configuration pages and execute arbitrary code remotely.
Following the disclosure of those vulnerabilities, the Shadowserver Foundation began actively monitoring exposed systems.
Progress Software has faced major cybersecurity incidents before. In 2023, attackers linked to the Cl0p ransomware group exploited a vulnerability in the company’s MOVEit managed file transfer software, launching widespread attacks against organizations around the world.
(ll)
