CVE-2026-84295

Improper authentication in Progress WS_FTP Server on Windows

CVSS 3.1: 10.0 critical
EPSS: —
Published: Oct 29, 2026 · 3d ago
Modified: Oct 30, 2026

Analyze CVE-2026-84295 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Progress Software WS_FTP Server on Windows has an improper authentication flaw in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can reach the server over the network with no user interaction and obtain sensitive information, including administrative credentials. Windows deployments of those WS_FTP Server releases are affected.

What to do: Upgrade WS_FTP Server to 2024.0.6 or 2025.0.3.

Product	Affected	Fixed in
Progress Software WS_FTP Server	versions prior to 2024.0.6 and 2025.0.3 on Windows	2024.0.6 and 2025.0.3

Estimated exposure

No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Weakness: CWE-287, CWE-522

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.