Progress patches five high-severity flaws in WS_FTP Server
The recommended build is 2025.0.5, also called 10.0.5; the notice reports no active exploitation.
62
CVE-2026-115340
Cleartext credential storage in Progress WS_FTP Server before 2025.0.5
- CVSS 3.1
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Progress Software WS_FTP Server on Windows may write user credentials and session data to a temporary file during file transfers. A local attacker with low privileges can trigger this without user interaction and read or modify that sensitive data. Versions prior to 2025.0.5 are affected.
What to do: Upgrade Progress WS_FTP Server on Windows to 2025.0.5.
| Product | Affected | Fixed in |
|---|---|---|
| Progress Software WS_FTP Server | versions prior to 2025.0.5 on Windows | 2025.0.5 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
- Weakness
- CWE-312, CWE-522
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N