Progress tells ShareFile on-premises users to power down servers over reported threat

Progress Software has begun contacting organizations that run Storage Zone Controllers for its ShareFile platform, directing them to turn off the associated Windows servers at once because of what the firm calls a "credible external security threat" aimed at the on-premises component.

Progress emails customers with urgent instructions. In a message sent July 9, 2026 and headed "Service Disruption. Immediate Action Required," the company stated, "We have reason to believe there is a credible external security threat targeting Progress Software's ShareFile Storage Zone Controllers."

The vendor added that it sees "no indication of unauthorized access to any Progress ShareFile accounts or data" and has therefore blocked cloud access for all accounts tied to Storage Zone Controllers.

Cloud access disablement deemed insufficient. Simply cutting off the cloud connection proved inadequate, according to Progress, which told recipients they must also shut down the servers themselves. "You must manually shut down the server hosting your Storage Zone Controllers. This is a critical additional step to ensure the safety of your data," the email instructed.

ShareFile itself functions as an enterprise-grade secure file sharing and collaboration service whose default storage lives in Progress's cloud.

Storage Zone Controllers explained. Customers may choose a hybrid model by installing Storage Zone Controllers on their own Windows servers so that files stay inside corporate storage. In such setups the ShareFile cloud still manages login, permissions, sharing links and oversight, while routing actual upload and download traffic through the on-premise controller to reach the local disks.

Because these controllers sit between the internet-facing cloud service and internal storage, they are normally reachable from outside the organization.

Investigation and next steps outlined. The company said it took the temporary measures "out of an abundance of caution" and is now collaborating with both internal staff and outside cybersecurity specialists to examine the situation. A further customer notice is promised inside 24 hours. The ShareFile status page currently warns that installations relying on Storage Zone Controllers remain offline.

Progress has not revealed whether the risk stems from a previously unknown flaw or if any controllers have already been breached. The alert follows a pattern of earlier campaigns that singled out internet-exposed enterprise file-transfer and sharing products, including the Clop gang's 2023 zero-day attacks on Progress MOVEit Transfer.