CVE-2026-2699 Progress ShareFile Authentication Bypass

Progress ShareFile Authentication Bypass Detection Artifact Generator Tool

Description

This Detection Artifact Generator verifies if Progress ShareFile instance is vulnerable to CVE-2026-2699 authentication bypass.

Detection Artifact Generator sends GET request to /ConfigService/Admin.aspx endpoint and verifies the response.

ATTENTION - this tool does not perform the full exploitation (zone takeover) and does not chain this vulnerability with RCE (CVE-2026-2701).

Detection in Action

Test against vulnerable instance:

$ python3 watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py -H http://sharefile.lab.local
                         __         ___  ___________                   
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py
        (*) CVE-2026-2699 Progress ShareFile Authentication Bypass - Detection Artifact Generator

          - Sonny and Piotr of watchTowr 

        CVEs: CVE-2026-2699

[+] Detection Artifact Generator Started
[+] Sending GET to /ConfigService/Admin.aspx
[+] PROBABLY VULNERABLE

Test against not vulnerable instance:

$ python3 watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py -H http://sharefile.lab.local
                         __         ___  ___________                   
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________ 
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|   
                                  \/          \/     \/                            
          
        watchTowr-vs-Progress-ShareFile-CVE-2026-2699.py
        (*) CVE-2026-2699 Progress ShareFile Authentication Bypass - Detection Artifact Generator

          - Sonny and Piotr of watchTowr 

        CVEs: CVE-2026-2699

[+] Detection Artifact Generator Started
[+] Sending GET to /ConfigService/Admin.aspx
[-] PROBABLY NOT VULNERABLE: 403 status code

Affected Versions

< ShareFile Storage Zones Controller 5.12.4

References:

Follow watchTowr Labs

For the latest security research follow the watchTowr Labs Team

• https://labs.watchtowr.com/

• https://x.com/watchtowrcyber