CVE-2026-16139 affects In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2. The vulnerability arises from improper validation in the download preparation flow, which an authenticated zone administrator can exploit to write files outside the designated preparation directory. This improper validation can lead to remote code execution in version 5.x, while such impact is not confirmed for version 6.x. The CVSS v3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An authenticated zone administrator can exploit this vulnerability to write files outside the intended directory, potentially leading to remote code execution in version 5.x. This could allow an attacker to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability. The impact on version 6.x is less clear, with remote code execution not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict zone administrator privileges to trusted personnel and monitor for suspicious activity related to file handling in the download preparation flow.