Progress confirms zero-day vulnerability behind ShareFile disruption – vendor issues patch to restore service

Progress Software has confirmed that a zero-day vulnerability in its ShareFile file-sharing platform was the root cause of the recent service disruption affecting customers who run the Storage Zones Controller component. The company has rolled out a fix and says it is restoring access for affected customers as they apply it.

The disruption was initially visible to customers as instability and blocked access rather than a disclosed security issue: the vendor's confirmation that a zero-day exploit was behind it reframes the outage as a security incident, not a reliability one.

Why it matters

File-transfer and managed file-sharing products sit directly on sensitive data flows, and they have been one of the most consistently targeted categories of enterprise software in recent years. When a vendor confirms exploitation of an undisclosed flaw, the window between "service disruption" and "data exposure" can be very small, which is why the distinction between an outage and an incident matters for how you respond.

Storage Zones Controller is the self-managed piece of ShareFile: it runs in the customer's own environment. That means applying the vendor's fix is the customer's responsibility, not something Progress can patch centrally for everyone.

File-transfer software keeps ending up here

Progress has been through this before with a different product: the 2023 compromise of MOVEit Transfer, exploited as a zero-day by the Cl0p extortion group, became one of the largest data-theft events on record, ultimately touching thousands of organizations and tens of millions of individuals downstream. Before that came GoAnywhere MFT and Accellion FTA – different vendors, same playbook: find an undisclosed flaw in a managed file-transfer product, exploit it quietly at scale, and extort the customers whose data was sitting inside.

The reason attackers keep returning to this category is structural. File-transfer platforms are, by design, internet-reachable, credential-rich, and full of exactly the data organizations consider too sensitive for email. A single working exploit does not need lateral movement or privilege escalation to be profitable: the target data is already in the box the exploit opens. That history is the lens through which a "service disruption" caused by a confirmed zero-day should be read.

Are you affected

• You run ShareFile with a self-hosted Storage Zones Controller in your own infrastructure or private cloud.
• You experienced unexplained ShareFile disruptions or access blocks in recent days.
• You have not yet applied the vendor-supplied patch released in response to this incident.

What to do now

Apply the vendor-supplied patch to every Storage Zones Controller instance before restoring normal service – Progress is gating restoration on the fix for a reason. Treat the event as a potential security incident until proven otherwise: review access logs around the disruption window for anomalous activity, and if you find signs of unauthorized access, follow your incident-response process rather than simply returning to business as usual.

Frequently asked questions