WS_FTP
Security incidents tagged WS_FTP. Newest first.
1 WS_FTP incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 27 days (Sep 4–Sep 30)
- Patched
Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4
Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.
Progress WS_FTP ServerSince Oct 29, 2026
