Progress orders immediate shutdown of all ShareFile Storage Zone Controllers after credible external threat

The directive followed a customer posting the company email on r/sysadmin and Progress marking the service not operational on its status page. Only self-hosted controllers are affected; cloud-only accounts remain reachable. The controller sits at the network edge, exposing file-management endpoints that regulated industries use to keep data on-premise while leveraging ShareFile orchestration. Progress stated it has no indication of account or data access but provided no technical detail on the threat vector or actor.

This action mirrors the 2023 Citrix response to CVE-2023-24489, when unauthenticated flaws led to CISA alerts and forced cloud disconnection of unpatched controllers. Progress acquired ShareFile in 2024 after the MOVEit Clop campaign exposed similar file-transfer supply-chain risk. Two additional critical controller flaws patched in March 2025 were never linked to active exploitation, yet the current full-offline order suggests either a zero-day or credential compromise that patching cannot remediate.

Regulated-sector deployments now face production disruption with no restart timeline. Edge exposure plus prior unauthenticated RCE patterns indicate the controllers remain high-value targets for data exfiltration or ransomware staging. Operators must preserve logs, scan for unexpected .aspx artifacts, and treat every controller as potentially compromised until Progress publishes indicators and a verified remediation path.

Progress has not disclosed whether the threat originates from a newly discovered flaw, stolen signing keys, or an upstream compromise. Customers are instructed to remain offline until explicit clearance is issued.