CVE-2026-84296: SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WSFTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.6 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.3
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authenticated to the WS_FTP Server SSH component. The issue affects Windows deployments and allows improper association of authentication factors between accounts to bypass MFA requirements.
Which versions are affected?
WS_FTP Server versions earlier than 2024.0.6 are affected, as is the 2025 release line before 2025.0.3. The provided information applies to the SSH component on Windows.
What is the impact of a successful bypass?
A successful attacker can bypass MFA requirements. The supplied severity vector indicates high confidentiality and integrity impact, with no availability impact.