CVE-2026-115339: Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
Published Nov 9, 2026
·Updated
Insufficient resource limits in Progress Software WSFTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.
Affected Software
1 affected component
Progress Software WS_FTP Server<2025.0.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.5
Event History
Nov 9, 2026
CVE Published
via MITRE·04:46 PM
Data Sourced
via MITRE·04:46 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
Windows installations of Progress WS_FTP Server running a release earlier than 2025.0.5 are affected.
2
Does exploitation require credentials or user interaction?
No. The issue can be exploited remotely by an unauthenticated attacker and does not require user interaction.
3
What is the likely impact of a successful attack?
A successful attack can exhaust server resources and cause a denial of service. The provided information does not indicate confidentiality or integrity impact.