CVE-2023-24489: Progress ShareFile Storage Zone — Immediate Shutdown Ordered (July 2026)

CVE-2023-24489 — Progress ShareFile Storage Zone

CVE-2023-24489 is a high-severity vulnerability affecting Progress ShareFile Storage Zone Controllers, with a credible external threat prompting Progress Software to order an immediate shutdown of all internet-facing Windows servers running this component. No active exploitation or unauthorized access has been confirmed, but the risk profile is severe enough to warrant full service disruption as of July 10, 2026.

Attack Vector

The vulnerability targets on-premises Storage Zone Controllers exposed to the internet. Attackers could potentially exploit weaknesses in the controller’s authentication or file handling mechanisms to gain unauthorized access to sensitive files stored on local infrastructure. The attack requires network access to the controller, typically via exposed ports or web interfaces. No indicators of compromise (IOCs) have been published, and the exact exploit method remains under investigation.

Who Is at Risk

Organizations using Progress ShareFile with on-premises Storage Zone Controllers—especially those deployed in a hybrid (on-prem/cloud) model—are at immediate risk. The shutdown directive applies globally to all customers with internet-facing Windows servers running Storage Zone Controller. Progress Software and its ShareFile Storage Zone customer base are directly affected.

Patch & Mitigate

• Patch: No patch or hotfix is currently available. Progress Software has not provided a remediation timeline.
• Workaround: Immediate shutdown of all internet-facing Storage Zone Controllers is mandatory. Cloud-side access has also been temporarily blocked by Progress.
• Detect: Monitor for any unusual access attempts or failed logins in Windows event logs and ShareFile controller logs. Review firewall logs for unexpected inbound connections to Storage Zone Controller ports.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application: The vulnerability may allow attackers to exploit internet-exposed Storage Zone Controllers.
• T1078 — Valid Accounts: Attackers could attempt to leverage stolen credentials if authentication bypass is possible.
• T1005 — Data from Local System: Successful exploitation could expose sensitive files stored on local infrastructure.

Source: https://securityaffairs.com/195194/hacking/progress-told-sharefile-customers-to-pull-the-plug-on-their-servers-heres-what-we-know.html