# CVE-2024-10022: Progress ShareFile Storage Zones Controller Zero-Day

> Progress Software patches a critical zero-day in ShareFile Storage Zones Controller. Learn how to detect and mitigate this improper access control exploit.

- Published: 2026-07-15T10:07:10.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: CVE-2024-10022, Progress Software, ShareFile, Zero-Day, RCE
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/progress-confirms-zero-day-vulnerability-behind-sharefile-disruption/
- Canonical: https://runtimerebel.com/blog/cve-2024-10022-progress-sharefile-storage-zones-controller-zero-day

## Key points

- Attackers can exploit an improper access control vulnerability to gain unauthorized access to data stored within customer-managed environments.
- Impacted software includes Progress ShareFile Storage Zones Controller versions prior to the latest security release.
- Organizations must immediately update to the latest patched version and monitor for indicators of unauthorized data access.

Progress Software has addressed a critical [Zero-Day](/glossary#zero-day) vulnerability, identified as [CVE-2024-10022](https://nvd.nist.gov/vuln/detail/CVE-2024-10022), impacting the ShareFile Storage Zones Controller. This incident led to service disruptions as the vendor moved to disable affected instances to protect customer data. According to [SecurityWeek](https://www.securityweek.com/progress-confirms-zero-day-vulnerability-behind-sharefile-disruption/), the vulnerability allowed for unauthorized access to customer-managed storage environments, bypassing standard authentication protocols.

## Technical Analysis of CVE-2024-10022

The [CVE](/glossary#cve) stems from an improper access control flaw within the Storage Zones Controller component. This component is essential for organizations that prefer to store their files on-premises or within a private cloud while maintaining integration with the ShareFile control plane. Because the Storage Zones Controller acts as the gateway between the public internet and the private storage repository, any failure in access validation poses a significant risk of data exfiltration.

While specific [TTP](/glossary#ttp) details are often withheld during the initial remediation phase, improper access control in this context typically implies that an unauthenticated attacker could craft specific requests to the controller to gain the same privileges as a legitimate user. Given the [CVSS](/glossary#cvss) score of 9.8, the vulnerability is considered highly exploitable. Successful exploitation could potentially lead to [RCE](/glossary#rce) or the complete compromise of the storage zone, allowing for the unauthorized manipulation or theft of sensitive corporate data.

### How to Detect CVE-2024-10022 Exploit Attempts

Security teams must focus on log analysis to identify potential compromise. To effectively **detect CVE-2024-10022 exploit** attempts, analysts should scrutinize IIS logs on the Storage Zones Controller for unusual HTTP POST or GET requests originating from unknown IP addresses, particularly those targeting administrative or configuration endpoints. 

Integrating these logs into a [SIEM](/glossary#siem) can help correlate suspicious activity with other network anomalies. Look for an influx of 403 (Forbidden) or 401 (Unauthorized) errors followed by a successful 200 OK response on sensitive paths, which may indicate an attacker attempting to find the correct bypass mechanism. Any evidence of [Lateral Movement](/glossary#lateral-movement) from the controller host into the broader corporate network should be treated as a high-confidence [IoC](/glossary#ioc).

## Mitigation and Long-term Defense

The primary remediation step is the immediate application of the **ShareFile Storage Zones Controller patch** provided by Progress Software. This update corrects the underlying access control logic to ensure all requests are properly validated before processing. Organizations that had their instances disabled by the vendor will need to apply this fix to restore service functionality.

Beyond immediate patching, defenders should align their architecture with [Zero Trust](/glossary#zero-trust) principles. This includes ensuring that the Storage Zones Controller is not directly exposed to the internet without additional layers of security, such as a Web Application Firewall (WAF) or a VPN. Deploying [EDR](/glossary#edr) agents on the controller hosts can provide deeper visibility into process execution, helping to identify post-exploitation activity such as the deployment of [C2](/glossary#c2) beacons.

Furthermore, the [SOC](/glossary#soc) should review the [MITRE ATT&CK](/glossary#mitre-att-ck) framework to map potential follow-on attacks, such as data staged for exfiltration. History suggests that vulnerabilities in file-sharing platforms are frequently targeted by [Ransomware](/glossary#ransomware) affiliates and [APT](/glossary#apt) groups looking for high-value intellectual property. Maintaining offline backups and rigorous access logging remains the best defense against the data loss associated with such campaigns.

**Related:** [Progress ShareFile Zero-Day Flaw Prompts Emergency Shutdown](/blog/progress-sharefile-zero-day-flaw-prompts-emergency-shutdown), [CVE-2026-35273: Oracle PeopleSoft RCE Exploited as Zero-Day by ShinyHunters](/blog/cve-2026-35273-oracle-peoplesoft-rce-exploited-as-zero-day-by-shinyhunters)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2024-10022-progress-sharefile-storage-zones-controller-zero-day