PT-2026-29736 · Progress · Sharefile+1

Piotr Bazydlo · Published 2026-03-16 · Updated 2026-04-27 · CVE-2026-2701

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Description An authenticated user is able to upload a malicious file to the server and subsequently execute it, resulting in remote code execution. The affected API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Code Injection

Unrestricted File Upload

Weakness Enumeration

CWE-78

CWE-94

CWE-434

Related Identifiers

BDU:2026-05923

CVE-2026-2701

Affected Products

Sharefile

Sharefile Storagezones Controller

References · 43

• https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2701 · Security Note
• https://twitter.com/syedaquib77/status/2040098915161125137 · Twitter Post
• https://twitter.com/syedaquib77/status/2040091712584929752 · Twitter Post
• https://twitter.com/CVEnew/status/2039744353757716767 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2039852240945483996 · Twitter Post
• https://twitter.com/Team_D4rkn3ttz/status/2039938511835668711 · Twitter Post
• https://twitter.com/TheHackersNews/status/2041199260939464914 · Twitter Post
• https://twitter.com/CybrPulse/status/2039706093551501517 · Twitter Post
• https://twitter.com/CveFindCom/status/2039715393305006116 · Twitter Post
• https://twitter.com/Shadowserver/status/2040000438653895021 · Twitter Post
• https://twitter.com/Shadowserver/status/2040000443863183469 · Twitter Post
• https://twitter.com/syedaquib77/status/2040098913403732232 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040642505822417316 · Twitter Post