CVE-2026-2699: exploitation status and patch state

CVE-2026-2699 · CVSS 9.8 CRITICAL

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Is CVE-2026-2699 exploited?

• Not in the CISA KEV catalog.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-2699

• Unauthenticated RCE Chain Exposes Customer Data in ShareFile Storage Zones (2026-04-04)

Primary sources

• NVD record
• Nuclei template

What this record does not say

• No EPSS score.
• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.