CVE-2026-84295: Improper Authentication in Progress WS_FTP Server

Published Oct 29, 2026

Updated

Improper authentication in Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2024.0.6
Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.3

Event History

Oct 29, 2026

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Windows deployments of Progress WS_FTP Server running versions earlier than 2024.0.6 or 2025.0.3 are affected.

Does exploitation require an account or user interaction?

No. The vulnerability can be exploited remotely by an unauthenticated attacker and does not require user interaction.

What could an attacker obtain?

An attacker could access sensitive information, including administrative credentials.