The vulnerability arises from inadequate validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient checks on queue service operations. A remote attacker who can reach the controller without authentication can chain these weaknesses to cause the system to send server‑side requests to arbitrary internal endpoints and to perform unauthorized queue operations, potentially compromising confidentiality, integrity, and availability of the underlying services.

Progress ShareFile Storage Zones Controller version 5.12.6 and earlier are affected. The official fix is provided in version 5.12.7 and later.

The CVSS score of 6.5 indicates moderate severity, and because the attack requires no authentication, it poses a significant risk to exposed installations. While EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the absence of authentication barriers means that an attacker with network access to the controller could exploit the server‑side request forgery and queue manipulation flaws. Exploitation would involve crafting a request that leverages the flawed outbound request handling to reach internal services and perform unauthorized queue operations.