The vulnerability CVE-2026-2699 affects the Customer Managed ShareFile Storage Zones Controller by Progress. It allows unauthenticated attackers to bypass access controls and reach restricted configuration pages. This flaw can be exploited to alter system configurations and potentially execute arbitrary code remotely. The issue is classified under CWE-698 (Execution After Redirect), indicating improper handling of redirects leading to unauthorized execution flow. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to gain unauthorized access to sensitive configuration settings and execute remote code on the affected system. This compromises system confidentiality, integrity, and availability, potentially leading to full system compromise. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the ShareFile Storage Zones Controller management interface to trusted administrators only and monitor for unauthorized access attempts. Avoid exposing the management interface to untrusted networks.