FlagThis
← Back to CVE List
Vulnerability Intelligence Report
Improper Authentication in Progress WS_FTP Server

CVE-2026-84295

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Authentication Bypass No Active Exploit Signals
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:6.1
EPSS Probability:0.55%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-287 ↗CWE-287: Improper Authentication
CWE-522 ↗CWE-522: Insufficiently Protected Credentials

Affected Products & Versions

Vendor Product Affected Versions
Progress Software WS_FTP Server 0 < 2024.0.6 (affected), 0 < 2025.0.3 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
0.553%
GitHub Advisory
GHSA-qwpp-fggf-7h3c ↗
Vulnerability Class
Authentication Bypass

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityProgress Software Corporation · Vendor · USA
Reserved2026-09-01T16:14:46
Published2026-10-29T15:45:08
Last Updated2026-10-30T17:18:25

Related Intelligence

Related CVEs
CVE-2023-40044 CVSS 10.0 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticate…
CVE-2026-90868 CVSS 9.9 — An OS command injection vulnerability in Progress Software WS_FTP Serv…
CVE-2023-42657 CVSS 9.9 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory tra…
CVE-2026-90866 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
CVE-2026-90864 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
LINK COPIED TO CLIPBOARD