CVE-2026-115338: Insecure XFT Transport in Progress WS_FTP Server

Published Nov 9, 2026

Updated

Insufficient protection of communications in Progress WSFTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.5

Event History

Nov 9, 2026

CVE Published

via MITRE·04:42 PM

Data Sourced

via MITRE·04:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

When is an installation exposed to interception or request modification?

An installation is exposed when it uses an affected WS_FTP Server version and allows unencrypted connections. A network attacker could then intercept sensitive information or modify requests.

What access does an attacker need to exploit this issue?

The attacker needs a network position that allows them to observe or interfere with the unencrypted connection. No authentication or user interaction is required according to the supplied vector.

Which versions should be remediated?

Progress WS_FTP Server versions prior to 2025.0.5 are affected. Upgrade to 2025.0.5 or later.

What can be done if an upgrade cannot be applied immediately?

Prevent use of unencrypted connections, since the described risk applies when communications are not encrypted.

CVE-2026-115338: Insecure XFT Transport in Progress WS_FTP Server

Remediation

Event History

Frequently Asked Questions

When is an installation exposed to interception or request modification?

What access does an attacker need to exploit this issue?

Which versions should be remediated?

What can be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

When is an installation exposed to interception or request modification?

What access does an attacker need to exploit this issue?

Which versions should be remediated?

What can be done if an upgrade cannot be applied immediately?