ShareFile API Secret Leak Attempt (CVE-2026-2699/CVE-2026-2701)

Tim Peck@timpeck

•updated Apr 2, 2026•2•0•105

This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.