CVE-2026-93694CWE-321CWE-362CWE-918ssrf
CVE-2026-93694
Medium · published October 12, 2026
What it is
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
The record
Technical detail
- CVSS v3.1
- 4.0 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00072 · 0.1th percentile
- Weaknesses
- CWE-321 · Use of Hard-coded Cryptographic Key; CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-918 · Server-Side Request Forgery (SSRF)
- Published
- 2026-10-12T17:17Z
References (1)
EPSS history
Timeline
14 OCT 03:33Z
EPSS moved — → 0%
epss
12 OCT 12:50Z
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
cvelistv5
12 OCT 12:50Z
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
cvelistv5