Progress Software WS_FTP Server: Privilege escalation via missing authorization
Summary
WS_FTP Server on Windows contains a missing authorization check in its administrative interface. A delegated Host Administrator can exceed their authorized scope, which may allow arbitrary command execution with elevated privileges and full compromise of the underlying server. The attacker needs a valid account with the delegated Host Administrator role, so the risk is mainly from compromised admin accounts, malicious insiders or chaining with another flaw.
Affected
- Progress Software WS_FTP Server on Windows before 2024.0.7
- Progress Software WS_FTP Server on Windows before 2025.0.4
Fixed in
- Upgrade to 2024.0.7 or later (2024 branch)
- Upgrade to 2025.0.4 or later (2025 branch)
Workaround
- No workaround is documented for this CVE; upgrading is the only reported remediation.
- Limit delegation of the Host Administrator role to trusted staff.
- Review existing Host Administrator accounts and their scope and permissions.
- Contact Progress Software Technical Support for guidance on available mitigations.
Exploitation
- No evidence of exploitation in the wild found at the time of writing.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Note: WS_FTP was heavily targeted in 2023 by different flaws (CVE-2023-40044, CVE-2023-42657).
Our recommendation
- Patch WS_FTP Server on Windows to 2024.0.7 or 2025.0.4 (or later) with high priority.
- Also patch to the latest fixed release for other same-day Progress fixes, especially CVE-2026-84295 (CVSS 10.0, fixed in 2024.0.6 and 2025.0.3).
- Check whether the administrative interface is reachable from the internet and restrict access.
- Review and reduce delegated Host Administrator accounts.
- Monitor admin logs for unusual configuration changes or command execution on the server.
- Check the NVD record and CISA KEV listing, as the CVE was still awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress Software advisory progress.lightning.force.com
- VulDB vuldb.com
- OffSeq radar.offseq.com
- Strix www.strix.ai
- Security Online batch overview securityonline.info
- Wikipedia: WS_FTP en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:10.
Original description (NVD)
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.