CVE-2026-16138 PUBLISHED

Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

Assigner: ProgressSoftware
Reserved: 17.07.2026 Published: 17.08.2026 Updated: 18.08.2026

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Progress
Product	ShareFile Storage Zones Controller
Versions	Default: unaffected affected from 0 to 5.12.5 (incl.)

Solutions

Upgrade to ShareFile Storage Zones Controller version 5.12.6 or later.

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information

Problem Types

CWE-502: Deserialization of Untrusted Data CWE

Impacts

A user with write access to a Network share can achieve arbitrary code execution with the privileges of the service account.