The vulnerability is an unsafe deserialization flaw in the CICO service of Progress ShareFile Storage Zones Controller, which permits an attacker with write access to a network share to provide crafted metadata that can be deserialized and executed as code on the controller host. This flaw grants remote code execution capabilities against the Storage Zones Controller server, allowing the attacker to compromise confidentiality, integrity, and availability of the host and potentially pivot to other network resources. The weakness stems from the use of unchecked deserialization of untrusted input, classified as CWE-502.

The affected product is Progress ShareFile Storage Zones Controller, versions 5.12.5 and earlier. Any deployment of these versions that exposes a writable network share to users is vulnerable.

The CVSS score is 8, indicating a high severity level. The absence of an EPSS score does not preclude exploitation; the vulnerability requires privileged access to a writable share, but a user with that access can directly trigger the flaw. The issue is not listed in CISA's KEV catalog, but the high CVSS and the nature of the flaw suggest that if exploited, the attacker could execute arbitrary code on the host system. The attack vector is likely over the network share, necessitating write permissions and knowledge of the vulnerable service.