**Progress Software** has officially attributed last week's urgent **ShareFile Storage Zone Controller** shutdown to a newly identified, high-severity zero-day vulnerability. The revelation follows a period of intense investigation after the company issued a stark warning to customers to power down their **Windows** servers due to a "credible external security threat." ### Emergency Shutdown and Investigation Last week, **Progress** temporarily disabled access to all **ShareFile** accounts utilizing **Storage Zone Controllers** as it collaborated with cybersecurity experts to understand the nature of the threat. The proactive measure was taken to safeguard customer data and systems while the root cause was being determined. ### Path Traversal Vulnerability Identified In a recent update to customers, **Progress** detailed the vulnerability as a high-severity path traversal flaw impacting all 5.x and 6.x versions of the **ShareFile Storage Zone Controller**. This type of vulnerability can be particularly dangerous, allowing an authenticated administrative user to read arbitrary files accessible to the application's service account, write threat actor-controlled content to arbitrary directories, or enumerate the server filesystem layout. ### Patches Released, CVE Pending **Progress** has swiftly responded by releasing security updates, with versions 5.12.5 and 6.0.2 now available for the **ShareFile Storage Zone Controller**. Customers are strongly advised to install these updates as soon as possible to restore system security and bring their **Storage Zone Controllers** back online. A **CVE** identifier has been reserved for this vulnerability and is expected to be published within the next two weeks, providing the broader security community with specific details for tracking and defense. ### No Indication of Breach So Far Despite the severity of the vulnerability and the initial "credible source" warning, **Progress** has stated that there is currently no indication of unauthorized access to any **ShareFile** customer account or data. The company has also not identified any active threats related to this vulnerability in customer environments. ### Understanding Storage Zone Controllers **Storage Zone Controllers** are critical components for many organizations, acting as customer-managed **Windows** servers that enable on-premises file storage while leveraging **ShareFile's** cloud platform for authentication, permissions, auditing, and collaboration. Given their role in storing sensitive files, these controllers represent a significant target for threat actors, particularly those involved in data theft and extortion schemes. Further details regarding the vulnerability's discovery, the delay in **CVE** publication, and additional technical specifics are anticipated as **Progress** continues its investigation and communication with the security community.