CVE-2026-16138 — Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

CVE-2026-16138

Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service PUBLISHED

Description (CNA)

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

Affected (CNA)

Vendor / product	Versions
Progress / ShareFile Storage Zones Controller	affected 0 through 5.12.5

CWE

CWE-502

References

https://support.sharefile.com/s/article/ShareFile-Storage-Zone-Controller-SZC-Service-Disruption-Guidance-Login-Issues-and-Access-Information

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.