CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Progress WS_FTP Server: improper authentication lets an unauthenticated remote attacker reach administrative credentials (CVSS 3.1 10.0); fixed in 2024.0.6 and 2025.0.3, with the later builds 2024.0.7 and 2025.0.4 as the target

cve · CVE-2026-84295 single-source

Coverage
1
first 2026-10-31 → last 2026-10-31
Latest activity
2026-10-31
Progress WS_FTP Server: unauthenticated CVSS 10.0 flaw can expose admin credentials; fixed in 2025.0.4 and…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
5
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-84295, newest first. Check the date before acting on an older one.

  • Upgrade every WS_FTP Server on Windows to 2024.0.7 or 2025.0.4 now, partner-facing and internet-reachable instances first, and rotate its administrator credentials afterwards, because CVE-2026-84295 can expose them to an unauthenticated attacker and the upgrade does not change what was already read; an instance on an unsupported branch gets no patch from Progress, so take it off the network or migrate it.
    2026-10-31CVE-2026-84295 +2

Defender insights

What each entry about CVE-2026-84295 tells a defender to do, newest first.

2026-10-31NOTABLEProgress WS_FTP Server: unauthenticated CVSS 10.0 flaw can expose admin credentials; fixed in 2025.0.4 and 2024.0.7

Exposure · detection

Story timeline

  1. 2026-10-31CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found
    trending-vulnerabilitiesProgress WS_FTP Server: unauthenticated CVSS 10.0 flaw can expose admin credentials; fixed in 2025.0.4 and 2024.0.7

Hunting pivots

Affected products
Progress WS_FTP Server
Tags
auth-bypasspatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-31/progress-ws-ftp-server-cve-2026-84295-unauth-cvss-10 · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-10-31/progress-ws-ftp-server-cve-2026-84295-unauth-cvss-10 · ATT&CK page ↗

Entries about Progress WS_FTP Server: improper authentication lets an unauthenticated remote attacker reach administrative credentials (CVSS 3.1 10.0); fixed in 2024.0.6 and 2025.0.3, with the later builds 2024.0.7 and 2025.0.4 as the target (1)

2026-10-31 · view entry permalink →

NOTABLECVE-2026-84295 +2NATOA2

CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found

Progress, as CNA, published CVE-2026-84295 on 2026-10-29: improper authentication in WS_FTP Server on Windows that "could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials"; its CVSS 3.1 vector is network, low complexity, no privileges and no user interaction, scored 10.0, and the record names no component or endpoint (ENISA EUVD, 2026-10-29). Two further flaws carry an unauthenticated vector with high attack complexity: CVE-2026-90865, an OS command injection that could allow command execution with elevated privileges under certain configurations (9.0) (ENISA EUVD, 2026-10-29), and CVE-2026-90867, improper access control in the Web Admin console that could expose administrative functionality to remote authentication attempts (8.1) (ENISA EUVD, 2026-10-29). CSIRT Italia counts 6 critical and 3 high flaws in the release, of types including authentication bypass, remote code execution and arbitrary file read and write (CSIRT Italia, 2026-10-30).

The record for CVE-2026-84295 names versions before 2024.0.6 and 2025.0.3 as affected (ENISA EUVD, 2026-10-29), and the records for the other two name versions before 2024.0.7 and 2025.0.4 (ENISA EUVD, 2026-10-29), so 2024.0.7 or 2025.0.4 is the build to reach. CSIRT Italia lists 2025.0.3 (10.0.3) and 2024.0.6 (9.0.6) and earlier as affected and says that for unsupported versions the vendor will not release a workaround or patch (translated from Italian) (CSIRT Italia, 2026-10-30). No source reports exploitation: CISA's catalog holds no 2026 WS_FTP flaw, although CVE-2023-40044 in the same product has been listed since 2023-10-05 with known ransomware use (CISA KEV catalog, 2026-10-30).

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

ENISA EUVD (EUVD-2026-113016, Progress as CNA) 2026-10-29

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

ENISA EUVD (EUVD-2026-113022, Progress as CNA) 2026-10-29

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

ENISA EUVD (EUVD-2026-113024, Progress as CNA) 2026-10-29

for versions that are no longer supported the vendor will not release any workaround or patch (translated from Italian)

CSIRT Italia / ACN (alert AL10/261030/CSIRT-ITA) 2026-10-30
vulnerability31 Oct 04:14Zsingle-sourceOpen finding →
Sources: ENISA EUVD (EUVD-2026-113016, Progress as CNA) · ENISA EUVD (EUVD-2026-113022, Progress as CNA) · ENISA EUVD (EUVD-2026-113024, Progress as CNA) · CSIRT Italia / ACN (alert AL10/261030/CSIRT-ITA) · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • euvd.enisa.europa.eu3 (60%)
  • acn.gov.it1 (20%)
  • cisa.gov1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)