Is CVE-2026-93693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93693 being exploited in the wild.

How severe is CVE-2026-93693?

Medium severity, with a CVSS score of 6.5, published 12 October 2026.

Which products and versions are affected?

Citrix ShareFile Storage Zones Controller v5.12.6 and below.

Is there a fix for CVE-2026-93693?

Yes: fixed in ShareFile Storage Zones Controller v5.12.7, v6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93693 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-93693?

Check whether you run Citrix ShareFile Storage Zones Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93693: Citrix ShareFile Storage Zones Controller SSRF and unauthorized queue operations

CVE-2026-93693 · Severity: medium · CVSS 6.5 · Published 2026-10-12

ShareFile Storage Zones Controller is a component that manages cloud storage connectivity for enterprise file sharing. When exploited, these chained vulnerabilities allow attackers without credentials to manipulate storage jobs, trigger requests to internal services, write files to arbitrary locations, and potentially execute code on the affected server.

Vendors: Citrix.

Quick answers

Is CVE-2026-93693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93693 being exploited in the wild.
How severe is CVE-2026-93693?: Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?: Citrix ShareFile Storage Zones Controller v5.12.6 and below.
Is there a fix for CVE-2026-93693?: Yes: fixed in ShareFile Storage Zones Controller v5.12.7, v6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93693 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-93693?: Check whether you run Citrix ShareFile Storage Zones Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ShareFile Storage Zones Controller v5.12.7, v6

Technical details

Three chained vulnerabilities—SSRF via improper validation of outbound request destinations, unsafe JSONP response formatting, and insufficient queue service validation—permit an unauthenticated remote attacker to reach an unused connector SSO endpoint, induce the Storage Zones Controller to request internal services, create unauthorized copy jobs, and write attacker-controlled files. Writing executable content to an IIS-served directory could achieve remote code execution.

Affected products

Citrix ShareFile Storage Zones Controller v5.12.6 and below

Timeline

2026-10-12: disclosed

References

https://docs.sharefile.com/en-us/sharefile/storage-zones-controller/5-0/security-vulnerability-sep26

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.