# Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 · pwn.watch

> Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.

Page: https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 · generated 2026-10-29T20:46:10.933Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Progress WS_FTP Server
- Started: 2026-10-29
- CVEs: CVE-2026-84295, CVE-2026-90868, CVE-2026-90865, CVE-2026-90863, CVE-2026-90864, CVE-2026-90866, CVE-2026-90867, CVE-2026-84294, CVE-2026-90869, CVE-2026-84296, CVE-2026-90861, CVE-2026-90870, CVE-2026-90871, CVE-2026-90862, CVE-2026-90872
- Affected: WS_FTP Server (Windows) before 2024.0.7 and before 2025.0.4; CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296: before 2024.0.6 and before 2025.0.3
- Fixed in: 2024.0.7 (9.0.7); 2025.0.4 (10.0.4)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026.json
- This file: https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-29: Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials). (https://www.cve.org/CVERecord?id=CVE-2026-84295)
- 2026-10-01: Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs. (https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html)
- 2026-09-03: Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296. (https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html)

## Fix brief
# Security brief: Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4

Source: https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026 · status: live · severity: critical · updated Oct 29, 2026, 16:23 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.

Severity detail: Progress scores CVE-2026-84295 (unauthenticated, exposes admin credentials) CVSS 10, CVE-2026-90868 9.9 and CVE-2026-90865 9.0 (OS command injection), and three delegated Host Administrator scope-escape bugs 9.1. No in-the-wild exploitation has been reported yet, but WS_FTP was mass-exploited in 2023 within days of a disclosure.

- Product: Progress WS_FTP Server
- CVE / advisory ids: CVE-2026-84295, CVE-2026-90868, CVE-2026-90865, CVE-2026-90863, CVE-2026-90864, CVE-2026-90866, CVE-2026-90867, CVE-2026-84294, CVE-2026-90869, CVE-2026-84296, CVE-2026-90861, CVE-2026-90870, CVE-2026-90871, CVE-2026-90862, CVE-2026-90872

## Affected versions
- WS_FTP Server (Windows) before 2024.0.7 and before 2025.0.4
- CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296: before 2024.0.6 and before 2025.0.3

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 2024.0.7 (9.0.7)
- 2025.0.4 (10.0.4)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you run WS_FTP Server, upgrade to 2024.0.7 or 2025.0.4 with the full installer from the Progress Download Center. Keep the Web Admin console and Ad Hoc Transfer module off the internet where you can, and rotate WS_FTP administrator passwords if your server was reachable while unpatched.

## Latest updates
- Oct 29, 2026: Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials).
- Oct 1, 2026: Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs.
- Sep 3, 2026: Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296.

## Advisories
- [CVE-2026-84295: Improper authentication in Progress WS_FTP Server](https://www.cve.org/CVERecord?id=CVE-2026-84295) (CVE.org)
- [CVE-2026-90868: OS command injection in Progress WS_FTP Server](https://www.cve.org/CVERecord?id=CVE-2026-90868) (CVE.org)
- [CVE-2026-90865: OS command injection in Progress WS_FTP Server](https://www.cve.org/CVERecord?id=CVE-2026-90865) (CVE.org)
- [NVD: CVE-2026-84295](https://nvd.nist.gov/vuln/detail/CVE-2026-84295) (NVD)
- [CVE-2026-90872: Server-side script injection in WS_FTP Server Manager web UI](https://www.cve.org/CVERecord?id=CVE-2026-90872) (CVE.org)
- [What's New in WS_FTP Server 2025 (release history)](https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html) (Progress Software)
- [What's New in WS_FTP Server 2024 (release history)](https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html) (Progress Software)

---
Machine-readable: https://pwn.watch/i/progress-ws-ftp-server-cve-2026-84295-90868-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.