CVE-2026-93694: progress sharefile storage zones controller Use of Hard-coded Cryptographic Key

Vulnerability summary

CVE-2026-93694 is a medium (CVSS 4.0) Use of Hard-coded Cryptographic Key vulnerability in progress sharefile storage zones controller. EPSS estimates a 0.07% chance of exploitation in the next 30 days, higher than 0% of scored vulnerabilities.

Timeline

1. 12-10-2026
   PublishedVulnerability first disclosed.
2. 12-10-2026
   Last modifiedVulnerability information updated.

Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.