{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 · updates",
  "home_page_url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026",
  "feed_url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/feed.json",
  "description": "Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.",
  "language": "en",
  "_pwn": {
    "slug": "progress-ws-ftp-server-cve-2026-84295-90868-oct-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-29-5cdb92d6",
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-29-5cdb92d6",
      "title": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials).",
      "content_text": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials).\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-84295",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-84295",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-01-d56851f8",
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-01-d56851f8",
      "title": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs.",
      "content_text": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs.\n\nSource: https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html",
      "date_published": "2026-10-01T00:00:00.000Z",
      "external_url": "https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-09-03-f6319b50",
      "url": "https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-09-03-f6319b50",
      "title": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296.",
      "content_text": "Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296.\n\nSource: https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html",
      "date_published": "2026-09-03T00:00:00.000Z",
      "external_url": "https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html",
      "tags": [
        "critical"
      ]
    }
  ]
}