CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found

Progress, as CNA, published CVE-2026-84295 on 2026-10-29: improper authentication in WS_FTP Server on Windows that "could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials"; its CVSS 3.1 vector is network, low complexity, no privileges and no user interaction, scored 10.0, and the record names no component or endpoint (ENISA EUVD, 2026-10-29). Two further flaws carry an unauthenticated vector with high attack complexity: CVE-2026-90865, an OS command injection that could allow command execution with elevated privileges under certain configurations (9.0) (ENISA EUVD, 2026-10-29), and CVE-2026-90867, improper access control in the Web Admin console that could expose administrative functionality to remote authentication attempts (8.1) (ENISA EUVD, 2026-10-29). CSIRT Italia counts 6 critical and 3 high flaws in the release, of types including authentication bypass, remote code execution and arbitrary file read and write (CSIRT Italia, 2026-10-30).

The record for CVE-2026-84295 names versions before 2024.0.6 and 2025.0.3 as affected (ENISA EUVD, 2026-10-29), and the records for the other two name versions before 2024.0.7 and 2025.0.4 (ENISA EUVD, 2026-10-29), so 2024.0.7 or 2025.0.4 is the build to reach. CSIRT Italia lists 2025.0.3 (10.0.3) and 2024.0.6 (9.0.6) and earlier as affected and says that for unsupported versions the vendor will not release a workaround or patch (translated from Italian) (CSIRT Italia, 2026-10-30). No source reports exploitation: CISA's catalog holds no 2026 WS_FTP flaw, although CVE-2023-40044 in the same product has been listed since 2023-10-05 with known ransomware use (CISA KEV catalog, 2026-10-30).