Executive Summary
Security researchers have identified a critical pre-authentication remote code execution (RCE) chain affecting Progress ShareFile Storage Zone Controllers. The vulnerability stems from an 'Execution After Redirect' (EAR) flaw in the configuration interface combined with insecure handling of file upload paths and ZIP extraction.
Technically, CVE-2026-2699 allows an attacker to bypass authentication by ignoring a 302 redirect on the Admin.aspx page, gaining access to administrative configuration settings. By leveraging this access, attackers can modify the 'Network Share Location' to point to the webroot and use CVE-2026-2701 to upload a ZIP file containing a webshell, which the application extracts without renaming. This allows for full system compromise on customer-managed storage gateways. This is particularly critical as approximately 30,000 instances are internet-facing and these solutions often hold sensitive enterprise data to meet regulatory requirements.