Progress Software has instructed customers running the on-premises Storage Zone Controller component of its ShareFile file-sharing platform to immediately take the affected Windows servers offline, citing an unspecified security threat and declining to say what the threat actually is or who is behind it.
The order became public after a customer posted the company’s internal email to the r/sysadmin community on Reddit, and ShareFile’s own status page subsequently confirmed a service disruption tied to the shutdown. Progress says it has temporarily disabled access to affected accounts as a precaution and states it currently has no indication of unauthorized access to any ShareFile accounts or data, though the company has notably stopped short of ruling that possibility out entirely.
Only the Storage Zone Controller, an on-premises component that lets organizations host their own file storage while still using ShareFile’s cloud-based sharing layer, is affected; standard cloud-only ShareFile accounts are not part of the shutdown order. The controller typically sits at the edge of a customer’s network and is often reachable directly from the internet, an exposure that makes it a higher-value target than most internal-only enterprise software.
This is not the first time ShareFile’s Storage Zone Controller has drawn urgent attention. Back in 2023, while the product still belonged to Citrix, attackers exploited a separate flaw in the same component, prompting CISA to add it to its Known Exploited Vulnerabilities catalog and forcing a similar access cutoff at the time. More recently, watchTowr and Progress jointly patched two critical flaws in the controller that were publicly disclosed this past April, and Progress, which acquired ShareFile in 2024, had already been dealing with fallout from an unrelated mass file-transfer attack affecting a different product line.
Security teams running Storage Zone Controllers are advised to follow Progress’s shutdown instruction first and keep affected servers offline until the company clarifies the nature of the threat, confirm they are running a current build, either version 5.12.4 or later on the 5.x branch or a 6.x release, and treat any internet-reachable controller as a possible active incident by preserving logs and reviewing access records rather than simply waiting for an official all-clear.
