Progress patches five high-severity flaws in WS_FTP Server
Original title: Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks
The recommended build is 2025.0.5, also called 10.0.5; the notice reports no active exploitation.
Progress Software’s November 9, 2026 advisory covers five high-severity WS_FTP Server flaws that can expose credentials, disclose files or disrupt transfers. It recommends upgrading Windows installations to WS_FTP Server 2025.0.5. The supplied notice does not report exploitation. Public release notes retrieved for the report still listed 2025.0.4.
Unconfirmed: The article’s seven-flaw and path-traversal claims are not established by the supplied advisory, and public notes still list 2025.0.4.
- CVE-2026-115338, scored 8.1, can expose or alter unencrypted HTTP traffic to XFT.
- CVE-2026-115340, scored 7.1, can leave credentials in temporary transfer files.
- CVE-2026-115341, scored 7.7, may let an authenticated FTP user read files outside scope.
- CVE-2026-115339 and CVE-2026-35189, both scored 7.5, can exhaust memory.
- Releases 2024.0.8 and 2025.0.5 update bundled OpenSSL 3.5.8 to 3.5.9.
Impact: Credential exposure, out-of-scope file reads, or remote denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Progress Software WS_FTP Server | — | 2025.0.5 (10.0.5) |
| OpenSSL | 3.5.8 in affected WS_FTP packages | 3.5.9 |
- 1.Upgrade to WS_FTP Server 2025.0.5 using the full installer from the Progress Community portal.
- 2.Until patched, disable HTTP, require HTTPS, invalidate sessions, and rotate credentials sent over HTTP.
- 3.Do not replace the bundled OpenSSL library independently.
- Vendors
- Progress Software
- Products
- WS_FTP ServerOpenSSL
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-115338+3 related CVEs | Insufficient communication protection in WS_FTP Server before 2025.0.5 | 8.1 group max | — | ||
| CVE-2026-35189 | OpenSSL memory-growth DoS via crafted CRL distribution points | 5.3 | — |
From the original article
3 min read at cybersecuritynews.com
Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers. The company recommends upgrading Windows installations to WS_FTP Server 2025. 0.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.