CVE-2026-84295

Improper Authentication in Progress WS_FTP Server

State: Published
Severity: 10.0 Critical
Published: Oct 29, 2026
Updated: Oct 30, 2026
Reserved: Sep 1, 2026

Description

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-287 Improper Authentication
CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
WS_FTP ServerProgress Software	before 2024.0.6Affected before 2025.0.3Affected

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/viewvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.