---
id: CVE-2026-93694
title: >-
  In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing
  of queue items can send acknowledgements to an unvalidated callback URL, this
  behavior together with a race condition allows the attacker to cause
  FileCopyServi…
summary: >-
  In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing
  of queue items can send acknowledgements to an unvalidated callback URL, this
  behavior together with a race condition allows the attacker to cause
  FileCopyServi…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-321
  - CWE-362
  - CWE-918
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:17:10.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93694'
references:
  - url: >-
      https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26
    label: security@progress.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.116Z'
---

## Overview

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.