CVE-2026-84295
CriticalCVSS 10.0Summary
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Risk Assessment
Leakage of administrative credentials can enable full server compromise and further attacks within the network.
Recommendation
Update WS_FTP Server to version 2024.0.6 or 2025.0.3 (or later) and immediately rotate passwords and credentials for administrative accounts.
Other vulnerabilities in Progress Software WS_FTP Server
See all- CVE-2026-90872Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper neutralization of directives in dynamically evaluated code in the Manager web console. An authenticated Manager administrator could exploit this to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
- CVE-2026-90871Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper limitation of a pathname to a restricted directory. An unauthenticated attacker could exploit this to affect files outside the intended directory.
- CVE-2026-90870Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to a missing release of backend receiver sessions in the Ad Hoc Transfer component. This could lead to server resource exhaustion and service degradation.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Original NVD description (English source)
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS