URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat

Progress Software has told ShareFile customers to shut down the Windows servers running their Storage Zone Controllers, confirming to The Hacker News that it is responding to a "credible external security threat."
The company has temporarily disabled access to the affected accounts, a step it says it took "out of an abundance of caution" while it works with internal and external security experts.
It says it has no indication of unauthorized access to any ShareFile accounts or data, and that it notified customers after learning of the threat.
What Progress has not said is what the threat is or who is behind it.
The order became public when a customer posted the company's email to Reddit's r/sysadmin on July 10. Progress confirmed the disruption on its status page, listing Storage Zone Controller customers as "not operational" and the incident as under investigation as of a 12:12 p.m. EDT update.
Only the Storage Zone Controller is affected, not standard cloud-only ShareFile accounts. The controller is a server that a company runs itself, so files can stay on its own storage while it still uses ShareFile's cloud to share and manage them.
The controller usually sits at the network's edge, reachable from the internet. That exposure makes it both useful and a target. Ordering customers to take it fully offline, rather than just patch it, is a notable step.
That choice is itself a tell. If a fix for this threat existed, Progress would be telling customers to apply it; the shutdown order suggests there is none yet. That usually means a newly found flaw the company is racing to close, though the same step would also fit a threat a patch cannot address, such as stolen keys or a problem on Progress's own side.
Its statement that no accounts or data were accessed is careful wording, too, and does not rule out trouble on the controllers themselves.
What to do now
- Follow the shutdown order first. Keep the affected controllers offline until Progress says what the threat is and when it is safe to restart.
- Separately, confirm your version is current: 5.12.4 or later on the 5.x line, or a 6.x release. That closes the flaws fixed earlier this year, but Progress has not said it clears the current threat, so do not treat it as permission to restart.
- If a controller is reachable from the internet, handle it as a possible incident. Preserve the logs and start your incident-response process, then check for unfamiliar .aspx files in the web folders and storage paths you did not set. A clean-looking server is not proof that it is clean.
ShareFile has faced this before. In 2023, while the product still belonged to Citrix, attackers exploited an unauthenticated flaw in the same Storage Zones Controller (CVE-2023-24489).
CISA flagged it as actively exploited, and Citrix cut unpatched controllers off from the ShareFile cloud, the same access block Progress has now imposed.
Progress, which acquired ShareFile in 2024, had already weathered a mass file-transfer attack of its own: MOVEit, whose 2023 zero-day was exploited by the Clop group and hit more than 2,700 organizations.
The Storage Zones Controller also had two critical flaws that watchTowr disclosed in April and Progress patched in March, though the company has not connected the current threat to them, and neither has been reported as exploited.
The central question is still unanswered: Progress has pulled these systems offline and is working with outside experts, but has not said what the threat is or when customers can safely bring them back online.

Facts Only

* Progress told ShareFile customers to shut down Windows servers running their Storage Zone Controllers.
* The action was taken in response to a "credible external security threat."
* Access to affected accounts was temporarily disabled as a precaution.
* No indication of unauthorized access to ShareFile accounts or data was found by Progress.
* The order targeted Storage Zone Controllers, not standard cloud-only ShareFile accounts.
* The Storage Zone Controller is a self-run server accessible from the internet.
* Customers were advised to follow the shutdown order first and keep controllers offline until further instruction.
* Customers should confirm their software version is 5.12.4 or later on the 5.x line, or a 6.x release.
* If a controller is internet-reachable, logs should be preserved, and an incident response process should begin, including checking for unfamiliar .aspx files in web folders and storage paths.

Executive Summary

Progress has instructed ShareFile customers to shut down Windows servers hosting their Storage Zone Controllers in response to a credible external security threat. The company temporarily disabled access to affected accounts as a precautionary measure while consulting with security experts. Progress claims there is no evidence of unauthorized access to ShareFile accounts or data, and they notified customers after learning of the threat. The disruption specifically affects Storage Zone Controllers, which are self-run servers providing storage separate from cloud management.

Full Take

The decision to mandate an offline shutdown rather than a patch suggests the underlying threat might be beyond immediate remediation, possibly involving compromised keys or systemic issues within Progress's infrastructure, rather than a simple exploitable flaw that a fix could immediately address. This operational choice implies a race against time where full isolation is prioritized over immediate functionality. The reference to prior exploitation of similar controllers (CVE-2023-24489) and the subsequent access block by Citrix suggests a pattern where critical infrastructure components are targeted, and security responses often involve systemic access revocation rather than mere patching. The cautious assertion that no data was accessed requires scrutiny; while this may be true for ShareFile accounts, it does not eliminate the possibility of compromise or manipulation occurring directly on the controller servers themselves. The narrative skillfully frames the situation as an unknown external threat, positioning Progress and its customers in a reactive stance against an adversary whose identity remains concealed, which shifts the focus from immediate technical fixes to sustained operational uncertainty. What is missing is a clear timeline for the threat's identification, the nature of the vulnerability that necessitated this extreme measure, and independent verification of the security assurances provided by Progress regarding the integrity of the affected systems.

Sentinel — Human

Confidence

This analysis is highly likely human-written, exhibiting the layered contextualization and narrative flow characteristic of expert journalism synthesizing technical updates with historical precedent.

Signals Detected

Sentence length variance is erratic; strong use of specific domain-specific framing and implicit rhetorical pacing.

The text builds a sustained narrative tension based on withheld information, demonstrating a consistent focus despite technical details.

Effective weaving of specific historical context (MOVEit, CVEs) directly into the current narrative flow without relying on generalized attribution.

Specific references to dates, company actions, and technical vulnerabilities feel grounded in real-world reporting rather than pure generative synthesis.

Human Indicators

The text uses precise, layered juxtaposition of facts, historical precedent, and immediate action steps, suggesting the structure of a deep-dive investigative report rather than simple information delivery.

The tone shifts appropriately between reporting on corporate actions and providing direct, cautious advice to the reader.