Progress WS_FTP Server: Improper authentication with credential exposure
Summary
The flaw affects Progress Software WS_FTP Server on Windows in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can access sensitive information, including administrative credentials, without user interaction. The CVSS 10.0 score reflects high impact on confidentiality, integrity and availability, with a changed scope. A compromised server could serve as a starting point for attacks on the wider network.
Affected
- Progress Software WS_FTP Server on Windows, versions before 2024.0.6
- Progress Software WS_FTP Server on Windows, versions before 2025.0.3
Fixed in
- 2024.0.6 and 2025.0.3 according to the CNA record.
- Unverified: secondary sources cite 2024.0.7 and 2025.0.4 as fixed builds. Confirm the recommended build in the vendor advisory.
Workaround
Unknown. The vendor advisory could not be reviewed. Contact Progress Software Technical Support for guidance on available mitigations.
Exploitation
- No evidence of exploitation in the wild as of 29 Oct 2026 (OffSeq).
- No public exploit available according to VulDB and OffSeq.
- CISA KEV status not verified.
- Earlier WS_FTP flaws (CVE-2023-40044, CVE-2023-42657) were exploited in the wild, and a proof of concept for one was built by reverse-engineering the patch within days. Patch diffing of this fix is a realistic near-term risk.
Our recommendation
- Inventory all WS_FTP Server instances, their versions and whether they are internet-facing.
- Patch to the newest build named in the Progress advisory, and at least to 2024.0.6 or 2025.0.3. Patch the whole product, as other WS_FTP CVEs were published the same day.
- Until patched, do not expose the web and admin interfaces to the internet. Restrict them to trusted networks.
- Monitor administrative and authentication logs for unusual activity.
- After patching, rotate administrative and service credentials used with the server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress vendor advisory progress.lightning.force.com
- CVE-2026-84295 on Strix www.strix.ai
- CVE-2026-84295 on OffSeq Radar radar.offseq.com
- CVE-2026-84295 on ThreatInt cve.threatint.com
- Splunk security content commit (WS_FTP context) github.com
- The Record: WS_FTP vulnerabilities report therecord.media
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:52.
Original description (NVD)
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.