CVE-2026-93693: progress sharefile storage zones controller Improper Input Validation

Vulnerability summary

CVE-2026-93693 is a medium (CVSS 6.5) Improper Input Validation vulnerability in progress sharefile storage zones controller. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.1% of scored vulnerabilities.

Timeline

1. 12-10-2026
   PublishedVulnerability first disclosed.
2. 12-10-2026
   Last modifiedVulnerability information updated.

Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.