10.0
CriticalCVSS 3.1 · from ProgressSoftware
CVE-2026-84295
Improper Authentication in Progress WS_FTP Server
WS_FTP Server · Improper authentication · CWE-287AffectedWS_FTP Server
FixUpdate to 2024.0.6, 2025.0.3 or newer
PublishedOct 29, 15:45 · ProgressSoftware
ScoredOct 29 · 10.0 · ProgressSoftware
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
From ProgressSoftware
Affected and fixed versions
ProductAffectedFixed inWS_FTP Serverbefore 2024.0.62024.0.6WS_FTP Serverbefore 2025.0.32025.0.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known