CVE-2026-115340: Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
Published Nov 9, 2026
·Updated
Progress Software WSFTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
Affected Software
1 affected component
Progress Software WS_FTP Server<2025.0.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.5
Event History
Nov 9, 2026
CVE Published
via MITRE·04:47 PM
Data Sourced
via MITRE·04:47 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Windows deployments of Progress WS_FTP Server running versions earlier than 2025.0.5 may be affected, particularly while file transfer operations are occurring.
2
What access would an attacker need?
The severity vector indicates an attacker needs local access and low privileges. No user interaction is required.
3
What is the recommended remediation?
Update WS_FTP Server to version 2025.0.5 or later.