CVE-2026-84295 - Exploits & Severity

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows allows unauthenticated remote attackers to bypass authentication and access sensitive information, including administrative credentials.

An unauthenticated attacker over the network can bypass authentication to access sensitive information including administrative credentials, potentially enabling further compromise of the system and connected infrastructure.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch available - upgrade to WS_FTP Server version 2024.0.6 or 2025.0.3 or later

Immediately upgrade Progress Software WS_FTP Server to version 2024.0.6, 2025.0.3, or later. Until patching is complete, apply network-level access controls to restrict remote access to WS_FTP Server to trusted IP addresses only. Monitor logs for suspicious authentication attempts and unauthorized access patterns. Review administrative credentials for any signs of compromise.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-84295 . See article

NVD published the first details for CVE-2026-84295

A CVSS base score of 10 has been assigned.

GitHub Advisories released a security advisory .

Links to Mitre Att&cks

[critical] Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4

Progress WS_FTP Server CVE-2026-84295 and CVE-2026-90868: Critical Flaws Fixed in 2024.0.7 and 2025.0.4

Improper Authentication in Progress Software WS_FTP Server Vulnerability

CVE-2026-84295 - Improper Authentication in Progress WS_FTP Server

CVE-2026-84295 | Progress WS_FTP Server up to 2024.0.5/2025.0.2 improper authentication

Be the first to know critical vulnerabilities

Collect, analyze, and vulnerability reports faster using AI