CVE-2026-93693CWE-116CWE-20CWE-306CWE-918ssrf

CVE-2026-93693

Medium · published October 12, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.2th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-20 · Improper Input Validation; CWE-306 · Missing Authentication for Critical Function; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-12T17:17Z
References (1)
https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26 · [email protected]
EPSS history
Timeline
  • 14 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 12 OCT 12:48Z
    Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
    cvelistv5
  • 12 OCT 12:48Z
    Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
    cvelistv5