Back securityvulnerability.io

Improper Authentication in Progress Software WS_FTP Server Vulnerability High & Critical Vulnerabilities / 3h Progress Software - Ws Ftp Server - CRITICAL - CVE-2026-84295. A vulnerability in Progress Software's WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows enables unauthenticated remote attackers to exploit improper authentication methods, potentially gaining unauthorized access to sensitive information, including administrative credentials.

securityvulnerability.io • October 29, 2026

A vulnerability in Progress Software's WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows enables unauthenticated remote attackers to exploit improper authentication methods, potentially gaining unauthorized access to sensitive information, including administrative credentials.

WS_FTP Server Windows 0 < 2024.0.6

WS_FTP Server Windows 0 < 2025.0.3

Download the Critical Vulnerability Management Cheat Sheet

Vulnerability published Oct 29, 2026

Vulnerability published

Vulnerability Reserved Sep 1, 2026

Vulnerability Reserved

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Progress WS_FTP Server Disclosed On October 29, 2026, Progress Software disclosed two critical vulnerabilities in its WS_FTP Server: CVE-2026-84295 and CVE-2026-90868. CVE-2026-84295, rated CVSS 10.0, allows unauthenticated remote attackers to access sensitive information, including administrative credentials. CVE-2026-90868, rated CVSS 9.9, is an OS command injection flaw that can enable arbitrary command execution under certain configurations. Both vulnerabilities were patched in versions 2024.0.6 and 2025.0.3, released earlier in September and October 2026. As of the disclosure date, there is no evidence of exploitation in the wild, and neither vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Organizations using WS_FTP Server are advised to upgrade to the latest versions and review access permissions for administrative accounts. 4 sources 71

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)