Cyber Posture

CVE-2026-2701

Critical

Published: 02 April 2026

Published
02 April 2026
Modified
21 April 2026
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0072 72.7th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation directly mitigates CVE-2026-2701 by applying vendor patches that fix the unrestricted malicious file upload leading to remote code execution.

SI-10 Information Input Validation good match
prevent

Information input validation enforces checks on uploaded files to reject dangerous types and content that enable OS command injection and code injection.

SI-3 Malicious Code Protection good match
preventdetect

Malicious code protection scans and blocks execution of harmful files uploaded via the vulnerability, preventing RCE exploitation.

Security SummaryAI

CVE-2026-2701 is a high-severity vulnerability in ShareFile Storage Zones Controller version 5.0 that enables an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution. Published on 2026-04-02, it is linked to CWE-78 (OS Command Injection), CWE-94 (Code Injection), and CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical impact potential.

Exploitation requires an authenticated attacker with high privileges (PR:H) to access the network remotely (AV:N) under low complexity conditions (AC:L) with no user interaction (UI:N). Upon uploading and executing the malicious file, the attacker achieves remote code execution, granting high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H) across a changed scope (S:C), which could fully compromise the affected server.

The ShareFile advisory at https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26 provides details on the vulnerability, including recommended mitigations and patches.

Details

CWE(s)
CWE-78CWE-94CWE-434

Affected Products

progress
sharefile storage zones controller
5.0.0 — 5.12.4

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Vulnerability enables RCE via unrestricted upload of dangerous files (CWE-434 facilitating T1505.003 Web Shell), OS command injection (CWE-78 mapping to T1059), and exploitation of the remote Storage Zones Controller service (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References