Progress Patches 10.0 CVSS WS_FTP Server Flaw CVE-2026-84295 and 14 Other Bugs

TL;DR

Progress Software released security updates addressing 15 WS_FTP Server vulnerabilities on October 29, 2026. The most severe flaw, CVE-2026-84295, earns a maximum 10.0 CVSS score and allows unauthenticated attackers to steal administrative credentials. Administrators must apply the latest service releases immediately to protect corporate servers.

Notable CVEs

Why It Matters

Organizations deploy WS_FTP Server to handle mission-critical, automated file transfers and secure data exchanges. According to telemetry from Shodan, thousands of enterprise file transfer servers remain exposed to the public internet.

Historical campaigns show that threat actors frequently target file transfer gateways during initial intrusion phases. Leaving these WS_FTP Server vulnerabilities unpatched exposes enterprise networks to complete server takeover, credential theft, and data exfiltration. Progress Software and vulnerability databases indicate that no active exploitation in the wild has been confirmed. Additionally, researchers have not published any proof-of-concept exploit code for these bugs.

How the Attack Works

The advisory details severe authentication, authorization, and input validation weaknesses across web and transfer components.

Critical Authentication and Command Injection Flaws

First, CVE-2026-84295 carries a critical 10.0 CVSS rating due to flawed authentication logic. The vendor notes that “Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.” With these credentials, attackers can access management consoles without valid privileges.

Furthermore, Progress addressed two critical operating system command injection flaws. As stated in the advisory, “An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.” Attackers track this high-impact issue as CVE-2026-90868 (CVSS 9.9) and CVE-2026-90865 (CVSS 9.0). Both flaws allow attackers to execute arbitrary system commands on Windows hosts.

Path Traversal and Administrative Scope Bypasses

Similarly, several flaws break administrative boundaries. In CVE-2026-90863 (CVSS 9.1), the advisory explains that “Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope.” This gap allows attackers to execute commands with elevated privileges.

Meanwhile, path traversal bugs CVE-2026-90864 and CVE-2026-90866 (both CVSS 9.1) let delegated administrators write or modify unauthorized files. Additional vulnerabilities resolve multi-factor authentication bypasses (CVE-2026-84296 and CVE-2026-90862), denial-of-service vectors (CVE-2026-90869 and CVE-2026-90870), and cleartext password leaks (CVE-2026-90861).

Affected Versions

These WS_FTP Server vulnerabilities affect installations on Windows platforms. Specifically, flaws CVE-2026-84294, CVE-2026-84295, and CVE-2026-84296 affect versions prior to 2024.0.6 and 2025.0.3. The remaining twelve vulnerabilities impact versions prior to 2024.0.7 and 2025.0.4.

Patch and Mitigation Steps

Progress Software remediated all reported issues across its latest product builds. Administrators should visit the official Progress WS_FTP Server portal to obtain versions 2024.0.7 and 2025.0.4. Security teams must update production instances immediately. If administrators cannot upgrade right away, they should restrict administrative web consoles behind internal corporate networks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.