URGENT - Progress Tells Share File Customers to Shut Down Storage Zone Controllers Over Security Threat

Summary: Progress Software told ShareFile customers on July 10 to shut down the Windows servers running their Storage Zone Controllers, citing a "credible external security threat," and temporarily disabled access to the affected accounts while stating it had no indication of unauthorized access to ShareFile accounts or data. On July 14, Progress restored access, saying its investigation identified a high-severity vulnerability in the Storage Zone Controller affecting versions 5.x and 6.x, and released patched versions that return an affected controller to operation once applied.
Bottom line: The same Storage Zones Controller was exploited in 2023 through CVE-2023-24489, a flaw CISA flagged as actively exploited, and Progress's parent-era MOVEit zero-day hit more than 2,700 organizations - so a self-hosted controller at the network edge is a target with a track record, and this time the fix arrived only after a four-day shutdown.

Read the original at The Hacker News ↗

Topics: Data Breaches
Mentions: CVE-2023-24489
Related: CVE-2023-24489: Citrix Content Collaboration Share File Improper Access Control Vulnerability Known Exploited Vulnerabilities · Aug 16, 2023
Introducing CVE-2023-24489: A Critical Citrix Share File RCE Vulnerability Cyber Risks ·
TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026