Progress Patches Five High-Severity Flaws in WS_FTP Server

TL;DR

Progress Software released its November 2026 update to fix five high-risk bugs in Progress WS_FTP Server. Tracked as CVE-2026-115338 to CVE-2026-115341 and CVE-2026-35189, the flaws allow file leaks, traffic snooping, and server crashes. Admins must update to version 2025.0.5 right away to secure their hosts.

Notable CVEs

Why It Matters

Progress WS_FTP Server handles business file transfers across corporate networks worldwide. Consequently, security bugs in this tool put private data and server uptime at high risk.

Currently, neither source reports any active attacks in the wild or public exploit code for these bugs. Researchers Momen Elmady of Oxmatrix and Mateusz Mieczkowski of rexnets reported two of the issues. While exact install counts remain private, thousands of firms use WS_FTP to move critical files every day.

How the Attack Works

XFT Transport, Memory Drain, and File Leaks

First, CVE-2026-115338 (CVSS 8.1) hits the XFT service when servers allow plain HTTP connections. In that setup, a network attacker can snoop on private data or alter XFT requests. Second, CVE-2026-115341 (CVSS 7.7) stems from weak access rules in Thin Client Web Transfer. This flaw lets a logged-in FTP user read files outside their allowed folder scope.

Third, CVE-2026-115339 (CVSS 7.5) lets a remote attacker drain server memory and crash the XFT service. Fourth, CVE-2026-115340 (CVSS 7.1) happens during web file transfers. The advisory warns that “WS_FTP Server may write sensitive user credentials and session data to a temporary file.” As the vendor notes, “Access to that file could expose sensitive information.” Finally, CVE-2026-35189 (CVSS 7.5) is an OpenSSL flaw (CWE-770) where crafted client certs drain heap memory during TLS handshakes.

Affected Versions

All five bugs hit Progress WS_FTP Server for Windows builds before version 2025.0.5 (10.0.5). In addition, the OpenSSL memory bug (CVE-2026-35189) affects builds before 2024.0.8 (9.0.8) that request client certs.

Patch and Mitigation Steps

Progress Software fixed all five flaws in Progress WS_FTP Server 2025.0.5 and updated OpenSSL to 3.5.9 in 2024.0.8 and 2025.0.5. As the vendor warns, “There will be an outage to the system while the upgrade is running.” If admins cannot patch now, they should block HTTP on XFT, limit Web Transfer to trusted hosts, and turn off client-cert requests.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.