CVE-2026-84295 PUBLISHED

Improper Authentication in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 01.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2024.0.6 (excl.) affected from 0 to 2025.0.3 (excl.)

Workarounds

Contact Progress Software Technical Support for guidance on available mitigations.

Credits

Luu Tien Thanh (thalu93) finder

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

Problem Types

CWE-287: Improper Authentication CWE
CWE-522: Insufficiently Protected Credentials CWE

Impacts

Authentication Bypass - may enable further compromise of the affected WS_FTP Server