CVE-2026-115340 PUBLISHED

Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 22.10.2026 Published: 09.11.2026 Updated: 09.11.2026

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.1

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2025.0.5 (excl.)

Workarounds

Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

Momen Elmady (0xmatrix) finder

References

https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026

Problem Types

CWE-312: Cleartext Storage of Sensitive Information CWE
CWE-522: Insufficiently Protected Credentials CWE

Impacts

Collect Data from Common Resource Locations