Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 ยท updates https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure. en Thu, 29 Oct 2026 00:00:00 GMT Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials). https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-29-5cdb92d6 Thu, 29 Oct 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-84295">Source</a></p> Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs. https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-10-01-d56851f8 Thu, 01 Oct 2026 00:00:00 GMT critical <p><a href="https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html">Source</a></p> Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4: Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296. https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026#2026-09-03-f6319b50 Thu, 03 Sep 2026 00:00:00 GMT critical <p><a href="https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html">Source</a></p>