CVE-2026-115338

Insecure XFT Transport in Progress WS_FTP Server

Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115337

Folder Permission Bypass in Progress WS_FTP Server

Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115336

FTP Quota Accounting Bypass in Progress WS_FTP Server

Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115341

Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115339

Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server

Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115340

Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-84294

Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90872

Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90871

Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90870

Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90869

Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90868

OS Command Injection in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90867

Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90866

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90865

Command Injection via FTP Notification Variables in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

CVSS 3.1 · 9 Critical EPSS 1.1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90864

Host Administrator Path Containment Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90863

Privilege Escalation via Missing Authorization in WS_FTP Manager

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90862

Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90861

Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-84296

SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server

Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server