CVE-2026-16138CWE-502insecure-deserialization

CVE-2026-16138

High · published August 17, 2026

CVSS v3.1
8.0
EPSS
1%
Percentile
57.1
In the wild
Unconfirmed
What it is

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00828 · 57.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-08-17T18:20Z
Affected products (1)
ProductVersionsFixed in
progress/sharefile_storage_zones_controller< 5.12.65.12.6
References (1)
https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information · [email protected]
EPSS history
Timeline
  • 17 AUG 13:32Z
    Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service
    cvelistv5