Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4

Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.

Why this severity: Progress scores CVE-2026-84295 (unauthenticated, exposes admin credentials) CVSS 10, CVE-2026-90868 9.9 and CVE-2026-90865 9.0 (OS command injection), and three delegated Host Administrator scope-escape bugs 9.1. No in-the-wild exploitation has been reported yet, but WS_FTP was mass-exploited in 2023 within days of a disclosure.

Started

Oct 29, 2026

CVEs

CVE-2026-84295CVE-2026-90868CVE-2026-90865CVE-2026-90863CVE-2026-90864CVE-2026-90866CVE-2026-90867CVE-2026-84294CVE-2026-90869CVE-2026-84296CVE-2026-90861CVE-2026-90870CVE-2026-90871CVE-2026-90862CVE-2026-90872

• #Progress
• #WS_FTP
• #File transfer
• #Command injection
• Auth bypass