{"id":"CVE-2026-93693","aliases":["EUVD-2026-97365","GHSA-474p-wmhw-pxfq"],"status":"published","title":"Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0024,"percentile":0.1518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-20","CWE-306","CWE-918"],"published":"2026-10-12T12:48:53Z","modified":"2026-10-15T16:08:54Z","products":[{"vendor":"progress","product":"sharefile storage zones controller"}],"references":[{"url":"https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93693"},{"url":"https://github.com/advisories/GHSA-474p-wmhw-pxfq"}],"sources":{"cve":[{"id":"CVE-2026-93693","title":"Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","status":"published","published":"2026-10-12T12:48:53.652Z","modified":"2026-10-12T14:43:38.793Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-918","CWE-20","CWE-116","CWE-306"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-97365","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","status":"published","published":"2026-10-12T12:48:53Z","modified":"2026-10-12T14:43:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:22.074542Z"}],"ghsa":[{"id":"GHSA-474p-wmhw-pxfq","title":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound...","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","status":"published","published":"2026-10-12T15:32:16Z","modified":"2026-10-12T15:32:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:13:06.481163Z"}],"nvd":[{"id":"CVE-2026-93693","description":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","status":"published","published":"2026-10-12T13:17:33.313Z","modified":"2026-10-15T16:08:54.067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-20","CWE-116","CWE-306","CWE-918"],"updated_at":"2026-11-02T14:12:56.310333Z"}]}}