A zero-day path traversal vulnerability affecting Progress ShareFile Storage Zones Controller versions 5.x and 6.x was confirmed as the cause of a recent service disruption. The flaw allows an authenticated administrative user to read arbitrary files accessible to the service account, write attacker-controlled content to arbitrary directories, and enumerate the server filesystem. Progress prompted customers to shut down affected servers, developed and released patches, and restored service upon patch application. The vendor has not disclosed detailed technical information and reports no evidence of unauthorized access or active exploitation. The aggressive mitigation response suggests potential undisclosed risk or observed attacker activity.

The vulnerability allows authenticated administrative users to perform arbitrary file read and write operations and enumerate the filesystem, potentially leading to unauthorized data access or modification. The disruption caused by the vulnerability led to temporary service shutdowns for Storage Zones Controller customers. Although no confirmed customer data compromise or active exploitation is reported, the severity warranted immediate patching and service interruption.

Progress has released official patches for ShareFile Storage Zones Controller versions 5.x and 6.x. Customers should immediately apply these patches to restore secure operation. The vendor managed the remediation by prompting customers to shut down affected servers and then restore service after patching. Defenders should assume potential compromise and conduct appropriate incident response measures beyond patching. Patch status is confirmed as official fix available.