Progress orders ShareFile customers to power down controllers

Progress notified ShareFile customers on Friday that it had disabled access to accounts using Storage Zone Controllers and instructed customers to power down those controller servers immediately while it investigates a credible external security threat.

A message posted on the company’s customer forum stated, “We are aware of a credible external security threat targeting Progress ShareFile Storage Zone Controllers.” The post continued: “Please manually shut down the server hosting your Storage Zone Controllers as soon as possible while Progress continues its assessment with cybersecurity experts.”

In private notices to customers, the company described the account access restrictions as temporary and added, “At this time, we do not indicate unauthorized access to any Progress ShareFile accounts or customer data.” Progress has not provided a timeline for restoring access or released technical details about the threat.

A Storage Zone Controller is software that lets ShareFile customers keep files in private storage locations, either on-premises or with a third-party provider, while connecting to the ShareFile service. Customers manage these controllers and protect them with an application-specific password, so risks to those servers could affect organizations that store files behind the controllers.

Some users have pointed to two vulnerabilities fixed in March as possible targets. The flaws are tracked as CVE-2026-2699 (CVSS 9.8) and CVE-2026-2701 (CVSS 9.1). Security researchers have warned that, if the two issues are chained, an unauthenticated actor could change controller configuration settings and upload files that lead to remote code execution.

Progress has limited public updates to the forum post and customer notices. The company said it is working with cybersecurity specialists and investigators as it continues the assessment, but it has not named the technical indicators or confirmed whether the March fixes are related to the current event.

Affected customers were told to follow Progress’s shutdown instructions and to wait for further updates from the vendor as the investigation continues.