Skip to content
Critical Vulnerabilities in Progress WS_FTP Server Disclosed

Critical Vulnerabilities in Progress WS_FTP Server Disclosed

First seen 29 Oct 2026, 21:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 23:16 UTC
  • •CVE-2026-84295 allows unauthenticated access to sensitive information.
  • •CVE-2026-90868 enables command execution under specific configurations.
  • •Patches are available; immediate upgrades are recommended.

On October 29, 2026, Progress Software disclosed two critical vulnerabilities in its WS_FTP Server: CVE-2026-84295 and CVE-2026-90868. CVE-2026-84295 is an improper authentication flaw with a CVSS score of 10.0, allowing unauthenticated remote attackers to access sensitive information, including administrative credentials. CVE-2026-90868, rated 9.9, is an OS command injection vulnerability that could enable arbitrary command execution under certain configurations. Both vulnerabilities affect WS_FTP Server versions prior to 2024.0.6 and 2025.0.3, which were patched in September and October 2026. As of the disclosure date, there are no reports of exploitation or proof-of-concept code for these vulnerabilities. Organizations using WS_FTP Server are advised to upgrade to the latest versions to mitigate risks. The vulnerabilities have not yet been added to CISA's Known Exploited Vulnerabilities catalog.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
CVE-2026-84295 and CVE-2026-90868 published
Progress Software disclosed critical vulnerabilities in WS_FTP Server, affecting versions prior to 2024.0.6 and 2025.0.3.
Rescana
2026-10-29
Patches released for vulnerabilities
WS_FTP Server versions 2024.0.6 and 2025.0.3 were released in September 2026 to address CVE-2026-84295; versions 2024.0.7 and 2025.0.4 released in October 2026 fixed CVE-2026-90868.
Rescana
2026-10-29
CVE-2026-90867 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-29
CVE-2026-90865 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-29
CVE-2026-90872 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (14)

Following this threat?

Track CVE-2026-84295 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 4

Common questions

Which versions of WS_FTP Server are affected?
WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 are affected by these vulnerabilities.
Is there any evidence of exploitation?
No evidence of exploitation or proof-of-concept code has been reported as of the disclosure date.
What should organizations do to protect themselves?
Organizations should immediately upgrade to WS_FTP Server versions 2024.0.6, 2025.0.3, or later to mitigate the vulnerabilities.