CVE-2026-93693: CWE-918: Server-Side Request Forgery (SSRF) in Progress ShareFile Storage Zones Controller

Progress ShareFile Storage Zones Controller versions up to 5.12.6 suffer from an SSRF vulnerability due to improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on the queue service. A remote unauthenticated attacker can chain these issues to cause the server to issue requests to unintended local services and perform unauthorized operations on the queue service. This can lead to limited integrity and availability impacts. No known exploits in the wild have been reported. No vendor advisory or patch information is provided in the source data.

The vulnerability allows a remote unauthenticated attacker to cause the server to send requests to unintended local handlers and perform unauthorized queue operations. This can result in limited integrity and availability impacts, as indicated by the CVSS vector (no confidentiality impact, low integrity impact, low availability impact).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict network access to the affected service and monitor for unusual request patterns related to queue operations.