CVE-2026-93693
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
- Published
- Updated
- Reserved
- Assigned by
- ProgressSoftware
Description
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
Timeline
ID reserved
By ProgressSoftware
- 24 days later
· 24 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ProgressSoftwareCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
- CWE-918: Server-Side Request Forgery (SSRF) (opens in a new tab)All about CWE-918 and its CVEs
- CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
- CWE-116: Improper Encoding or Escaping of Output (opens in a new tab)All about CWE-116 and its CVEs
- CWE-306: Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs
Affected products
Progress · ShareFile Storage Zones Controller
- affected ≤ 5.12.6
What to do
Solution: Upgrade to ShareFile Storage Zones Controller v5.12.7 or later.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-93693)Record last updated .