CVE-2026-93694
4.0MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-321, CWE-362, CWE-918
Impact
Attackers can manipulate FileCopyService into processing rogue file metadata and content, leading to unauthorized data modification or partial service disruption. To exploit this, the attacker needs the ability to control copy queue items and win a specific race condition.
Root cause
The queue item processor contacts an unvalidated callback URL, which paired with a race condition allows spoofed metadata and content to be accepted by FileCopyService.
Affected systems
Progress ShareFile Storage Zones Controller v5.12.6 and below
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade to a Storage Zones Controller version newer than v5.12.6 as documented in the vendor security advisory. If upgrading must wait, restrict access to copy queue management and isolate outbound callback traffic.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.