CVE-2026-2699

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

59.51% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-284

Published

2026-04-02

Updated

2026-04-08

Proof-of-concept exploits (2)

• watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-26993★ · 2026-03-25
• 0xBlackash/CVE-2026-26990★ · 2026-04-09

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2699.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2026-26989
• CVE-2026-26990
• CVE-2026-26988
• CVE-2026-26991
• CVE-2026-26981
• CVE-2026-26992