An unauthenticated attacker can reach the Progress ShareFile Storage Zones Controller (SZC) and access restricted configuration pages. This flaw permits the attacker to alter system settings and potentially execute arbitrary code on the target system, exposing the organization to both data tampering and loss of service. The weakness is rooted in insufficient access control (CWE‑284) and insecure design (CWE‑698).

The vulnerability affects the Progress ShareFile Storage Zones Controller. No specific version range is listed in the available data; any deployed SZC instance is potentially impacted.

The CVSS score of 9.8 indicates a critical level of risk. The vulnerability is exploitable remotely by an unauthenticated user, meaning any external host can launch an attack without needing credentials. EPSS data is not available, but the absence from CISA’s KEV catalog does not eliminate the likelihood of exploitation; the critical score and ability to achieve remote code execution render the threat substantial and urgent.