[critical] Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 pwn.watch: incident updates (Patch now) / 3h Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fix

Progress Software published CVE records on Oct 29 2026 for a batch of WS_FTP Server vulnerabilities on Windows. The worst is CVE-2026-84295 (CVSS 10), improper authentication that could let an unauthenticated remote attacker access sensitive information including administrative credentials, fixed in 2024.0.6 and 2025.0.3. Two OS command injection bugs (CVE-2026-90868, CVSS 9.9, and CVE-2026-90865, CVSS 9.0, the latter with elevated privileges) could allow arbitrary command execution under certain configurations. Other records cover Web Admin console access control (CVE-2026-90867, 8.1), delegated Host Administrator scope escapes and path traversal (CVE-2026-90863, -90864, -90866, all 9.1), server-side script injection in the Manager web console that lets an authenticated Manager administrator run commands as the IIS worker process (CVE-2026-90872, 6.6), MFA bypasses, cleartext password exposure in activity logs, an SSH denial of service and unauthenticated Ad Hoc Transfer issues. Everything is fixed in WS_FTP Server 2024.0.7 and 2025.0.4, released Oct 1 2026. Earlier WS_FTP flaws (CVE-2023-40044) were mass-exploited shortly after disclosure.

Why this severity: Progress scores CVE-2026-84295 (unauthenticated, exposes admin credentials) CVSS 10, CVE-2026-90868 9.9 and CVE-2026-90865 9.0 (OS command injection), and three delegated Host Administrator scope-escape bugs 9.1. No in-the-wild exploitation has been reported yet, but WS_FTP was mass-exploited in 2023 within days of a disclosure.

Updated Oct 29, 2026, 16:23 UTC · on X ↗

WS_FTP Server (Windows) before 2024.0.7 and before 2025.0.4

CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296: before 2024.0.6 and before 2025.0.3

Oct 29, 2026 Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials).

Progress publishes 15 CVE records for WS_FTP Server, led by CVE-2026-84295 (CVSS 10, unauthenticated access to administrative credentials).

Oct 1, 2026 Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs.

Progress releases WS_FTP Server 2024.0.7 and 2025.0.4, which fix the remaining CVEs including both OS command injection bugs.

Sep 3, 2026 Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296.

Progress releases WS_FTP Server 2024.0.6 and 2025.0.3, which fix CVE-2026-84295, CVE-2026-84294 and CVE-2026-84296.

CVE-2026-84295: Improper authentication in Progress WS_FTP Server CVE.org · Oct 29, 2026

CVE-2026-90868: OS command injection in Progress WS_FTP Server CVE.org · Oct 29, 2026

CVE-2026-90865: OS command injection in Progress WS_FTP Server CVE.org · Oct 29, 2026

NVD: CVE-2026-84295 NVD · Oct 29, 2026

CVE-2026-90872: Server-side script injection in WS_FTP Server Manager web UI CVE.org · Oct 29, 2026

What's New in WS_FTP Server 2025 (release history) Progress Software

What's New in WS_FTP Server 2024 (release history) Progress Software