Progress has issued an emergency directive instructing organisations running ShareFile Storage Zone Controllers to manually power down their servers, offering no patch, no workaround, and scant detail about the underlying threat.
Summary
- Progress Software emailed affected ShareFile customers ordering immediate manual shutdown of Windows servers running Storage Zone Controllers.
- Progress has disabled cloud access to accounts using Storage Zone Controllers but says that step alone is insufficient protection.
- As of the follow-up notice, Progress states it has found no confirmed unauthorised access or active threat, yet insists servers remain offline.
- The nature of the threat, affected software versions, and a remediation timeline have not been disclosed.
- Progress previously dealt with mass exploitation of MOVEit Transfer by the Clop ransomware gang and patched two critical chained RCE flaws in ShareFile Storage Zone Controller v5 earlier this year.
The directive
Progress Software has taken the uncommon step of instructing a subset of its ShareFile customers to shut down the Windows servers hosting their Storage Zone Controllers — the on-premises component of the ShareFile platform that allows organisations to retain files on their own infrastructure. The instruction arrived by email and, according to customers, was followed up with direct phone calls from Progress staff. The company had already disabled cloud-side access to accounts using Storage Zone Controllers but was explicit that this was not sufficient: manual server shutdown was described as a critical additional step.
What Progress has said — and what it hasn’t
Progress described the situation as a response to a “credible external security threat” and characterised its actions as being taken “out of an abundance of caution” while internal and external security experts investigate. A follow-up notice issued over the weekend provided little further clarity. Progress stated it had “no indication of unauthorized access to any ShareFile customer account or data” and had “not identified any active threat,” yet continued to require Storage Zone Controllers remain offline. The company has not disclosed the nature of the threat, which software versions are affected, whether any customer environments have been compromised, or when servers may safely be brought back online. Progress did not respond to questions from The Register.
Context: architecture and exposure
Storage Zone Controllers typically reside on internet-facing Windows servers, acting as a bridge between an organisation’s on-premises file storage and Progress’s cloud management platform. That architecture makes them an attractive target if a remotely exploitable vulnerability exists. Progress patched two critical flaws in ShareFile Storage Zone Controller v5 earlier this year that could be chained to achieve unauthenticated remote code execution. Progress has not linked the current incident to those vulnerabilities, and the sources available do not confirm any connection.
Speculation in the absence of disclosure
The information vacuum has prompted conjecture among affected customers. One user on Reddit suggested that a directive to shut down servers entirely is consistent with an unauthenticated remote code execution vulnerability being actively exploited. That remains speculation; no source has confirmed the vulnerability class, exploitation status, or threat actor involved. What is clear is that Progress has concluded the risk of keeping systems running outweighs the operational disruption of taking them fully offline.
MOVEit is recent history
Progress carries recent and well-documented baggage in this space. The company spent much of 2023 and 2024 responding to mass exploitation of its MOVEit Transfer software by the Clop ransomware group — a campaign widely regarded as one of the largest supply chain breaches on record. That history is relevant context for how security teams should weigh the seriousness of Progress’s current response, even in the absence of technical specifics.
Why it matters
For CISOs, the unusual nature of this directive — shutdown with no patch, no CVE, and no remediation timeline — signals that Progress has assessed the potential exposure as severe enough to accept significant customer disruption. Organisations running ShareFile Storage Zone Controllers face an immediate business continuity question alongside the security one: critical file-sharing infrastructure is being taken offline indefinitely on vendor instruction. The incident also illustrates the systemic risk that on-premises components of hybrid SaaS platforms can introduce; they sit on your network, often internet-facing, and their vulnerability surface is yours to manage even when the vendor controls the software. CISOs should treat this as a prompt to audit where similar hybrid-architecture products exist in their environments and what their response options would be if a comparable directive arrived.
What to do now
- If your organisation runs ShareFile Storage Zone Controllers, confirm compliance with Progress’s instruction to manually shut down the hosting Windows server immediately.
- Verify that Progress has also disabled cloud-side access to your affected ShareFile accounts, as the company indicated it was doing for customers.
- Monitor Progress’s official communications channels for patch availability, remediation guidance, and any updated timeline for restoring services.
- Assess the business impact of extended ShareFile Storage Zone Controller downtime and activate any contingency file-sharing arrangements as needed.
- Review your broader inventory of on-premises components associated with hybrid SaaS platforms to understand where similar emergency shutdown scenarios could arise.
