CVE-2026-93693
6.5MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-20, CWE-116, CWE-306, CWE-918
Impact
Unauthenticated remote attackers can execute unauthorized queue operations and trigger server-side requests to internal endpoints over the network. They need network access to the exposed Storage Zones Controller service.
Root cause
Flawed outbound request validation, unsafe JSONP formatting, and missing authentication on the internal queue service combine to allow server-side request forgery.
Affected systems
Progress ShareFile Storage Zones Controller v5.12.6 and below
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade Progress ShareFile Storage Zones Controller to a version newer than v5.12.6 per vendor guidance; if unable to patch immediately, restrict inbound network access to the controller interface from untrusted networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.