--- schema: 1 kind: vulnerability title: "CVE-2026-84295, Progress WS_FTP Server: an unauthenticated remote authentication flaw can expose administrative credentials (CVSS 10.0), with two more unauthenticated flaws, fixed in 2025.0.4 and 2024.0.7; no exploitation found" headline: "Progress WS_FTP Server: unauthenticated CVSS 10.0 flaw can expose admin credentials; fixed in 2025.0.4 and 2024.0.7" summary: > Progress, as CVE numbering authority, published on 2026-10-29 CVE-2026-84295, an improper-authentication flaw in WS_FTP Server on Windows that could let an unauthenticated remote attacker reach administrative credentials (CVSS 3.1 10.0), together with an unauthenticated command injection under certain configurations (CVE-2026-90865, 9.0) and an access-control flaw in the Web Admin console (CVE-2026-90867, 8.1). Builds before 2024.0.7 and 2025.0.4 are affected, and CSIRT Italia counts 6 critical and 3 high flaws in the release and says Progress will issue no patch for unsupported versions. No source reports exploitation, and CISA's catalog holds no 2026 WS_FTP flaw, though a 2023 flaw in the same product is listed with known ransomware use. discovered_at: "2026-10-31T04:14:00Z" updated_at: null event_date: "2026-10-29" run_id: 2026-10-31T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, pre-auth, auth-bypass, rce, patch-available] regions: [global] sectors: [technology] entities: ["product:progress-ws-ftp-server"] techniques: [T1190, T1059] affected_products: ["Progress WS_FTP Server"] cves: - id: CVE-2026-84295 cvss: "10.0 (CVSS 3.1, Progress as CNA)" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [patch-available] affected: "WS_FTP Server on Windows, versions before 2024.0.6 and 2025.0.3 (2024 and 2025 branches)" fixed: "2024.0.6 and 2025.0.3; 2024.0.7 and 2025.0.4 carry the later fixes for the other two flaws and are the builds to reach; no patch for unsupported versions" - id: CVE-2026-90865 cvss: "9.0 (CVSS 3.1, Progress as CNA; attack complexity high)" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4, under certain configurations" fixed: "2024.0.7 and 2025.0.4; no patch for unsupported versions" - id: CVE-2026-90867 cvss: "8.1 (CVSS 3.1, Progress as CNA; attack complexity high)" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [patch-available] affected: "WS_FTP Server on Windows, versions before 2024.0.7 and 2025.0.4" fixed: "2024.0.7 and 2025.0.4; no patch for unsupported versions" sources: - url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113016" publisher: "ENISA EUVD (EUVD-2026-113016, Progress as CNA)" date: "2026-10-29" role: primary - url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113022" publisher: "ENISA EUVD (EUVD-2026-113022, Progress as CNA)" date: "2026-10-29" role: primary - url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113024" publisher: "ENISA EUVD (EUVD-2026-113024, Progress as CNA)" date: "2026-10-29" role: primary - url: "https://www.acn.gov.it/portale/w/progress-risolte-vulnerabilita-in-ws_ftp-server" publisher: "CSIRT Italia / ACN (alert AL10/261030/CSIRT-ITA)" date: "2026-10-30" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA KEV catalog" date: "2026-10-30" role: corroborating closed_sources: [] evidence: - quote: "Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials." publisher: "ENISA EUVD (EUVD-2026-113016, Progress as CNA)" source_url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113016" - quote: "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations." publisher: "ENISA EUVD (EUVD-2026-113022, Progress as CNA)" source_url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113022" - quote: "Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts." publisher: "ENISA EUVD (EUVD-2026-113024, Progress as CNA)" source_url: "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113024" - quote: "for versions that are no longer supported the vendor will not release any workaround or patch (translated from Italian)" original: "per le versioni non più supportate il vendor non rilascerà alcun workaround e/o patch" publisher: "CSIRT Italia / ACN (alert AL10/261030/CSIRT-ITA)" source_url: "https://www.acn.gov.it/portale/w/progress-risolte-vulnerabilita-in-ws_ftp-server" verification: single-source sourcing_note: > Progress is the CNA and disclosing party for its own product, and its CVE records, republished by ENISA's EUVD and GitHub's advisory database, carry the vulnerability text, the versions and the scores; Progress's own security bulletin is a script-rendered page that no transport could read, so its exploitation statement and any workaround text are unread, and CSIRT Italia's alert corroborates the counts and the lack of patches for unsupported versions without independent assessment. The absence of exploitation is the absence of a listing in CISA's catalog and of any report in the sources read, not a vendor statement; the build that fixes each CVE is taken from each record's own version text. confidence: medium references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every WS_FTP Server on Windows to 2024.0.7 or 2025.0.4 now, partner-facing and internet-reachable instances first, and rotate its administrator credentials afterwards, because CVE-2026-84295 can expose them to an unauthenticated attacker and the upgrade does not change what was already read; an instance on an unsupported branch gets no patch from Progress, so take it off the network or migrate it." updates: [] migrated_from: null --- Progress, as CNA, published CVE-2026-84295 on 2026-10-29: improper authentication in WS_FTP Server on Windows that "could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials"; its CVSS 3.1 vector is network, low complexity, no privileges and no user interaction, scored 10.0, and the record names no component or endpoint ([ENISA EUVD, 2026-10-29](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113016)). Two further flaws carry an unauthenticated vector with high attack complexity: CVE-2026-90865, an OS command injection that could allow command execution with elevated privileges under certain configurations (9.0) ([ENISA EUVD, 2026-10-29](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113022)), and CVE-2026-90867, improper access control in the Web Admin console that could expose administrative functionality to remote authentication attempts (8.1) ([ENISA EUVD, 2026-10-29](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113024)). CSIRT Italia counts 6 critical and 3 high flaws in the release, of types including authentication bypass, remote code execution and arbitrary file read and write ([CSIRT Italia, 2026-10-30](https://www.acn.gov.it/portale/w/progress-risolte-vulnerabilita-in-ws_ftp-server)). The record for CVE-2026-84295 names versions before 2024.0.6 and 2025.0.3 as affected ([ENISA EUVD, 2026-10-29](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113016)), and the records for the other two name versions before 2024.0.7 and 2025.0.4 ([ENISA EUVD, 2026-10-29](https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113022)), so 2024.0.7 or 2025.0.4 is the build to reach. CSIRT Italia lists 2025.0.3 (10.0.3) and 2024.0.6 (9.0.6) and earlier as affected and says that for unsupported versions the vendor will not release a workaround or patch (translated from Italian) ([CSIRT Italia, 2026-10-30](https://www.acn.gov.it/portale/w/progress-risolte-vulnerabilita-in-ws_ftp-server)). No source reports exploitation: CISA's catalog holds no 2026 WS_FTP flaw, although CVE-2023-40044 in the same product has been listed since 2023-10-05 with known ransomware use ([CISA KEV catalog, 2026-10-30](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). **Exposure:** any WS_FTP Server on Windows below 2024.0.7 or 2025.0.4; CSIRT Italia describes it as a secure file-transfer server used within organisations and with external partners, so instances reachable from partner or public networks come first ([CSIRT Italia, 2026-10-30](https://www.acn.gov.it/portale/w/progress-risolte-vulnerabilita-in-ws_ftp-server)). The records name no component for the authentication flaw, so no configuration is known to make an instance safe. **Detection:** no source publishes an indicator. For an instance that was reachable before the fix, the records to review are the web-server logs of the Web Admin console and the file-transfer server's own logons for administrator access from unfamiliar addresses, and process creation by the service or its web worker, since CVE-2026-90865 is command execution (an inference from the described flaw). **Defender takeaway:** upgrade to 2024.0.7 or 2025.0.4, partner-facing instances first, and rotate the administrator credentials afterwards, because the upgrade does not change credentials an attacker already read; take an instance on an unsupported branch off the network or migrate it.