Progress Software has told ShareFile customers using Storage Zone Controllers to immediately shut down their servers after discovering what it called a “credible external security threat,” BleepingComputer reported.
The company said it has no evidence that customer accounts or data have been accessed. However, as a safety measure, it has temporarily disabled access to affected ShareFile accounts and is asking customers to manually turn off the Windows servers running Storage Zone Controllers.
Progress said it is working with cybersecurity experts to investigate the issue and plans to provide another update within 24 hours. The company has not said if the threat is linked to a new software flaw or if any systems have been compromised.
In 2023, when ShareFile was still owned by Citrix, attackers exploited an unauthenticated vulnerability in its Storage Zones Controller, tracked as CVE-2023-24489. In response, Citrix blocked unpatched Storage Zones Controllers from connecting to the ShareFile cloud.
That same year, the Clop ransomware group exploited a zero-day vulnerability in MOVEit, compromising more than 2,700 organizations worldwide.
More recently, in April 2026, researchers disclosed two vulnerabilities affecting Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) that could be chained to achieve pre-authentication remote code execution. Progress addressed both vulnerabilities in Storage Zones Controller version 5.12.4, released on March 10, 2026. At present, there’s no evidence that either flaw has been exploited in the wild.