CVE-2026-84296

SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server

State: Published
Severity: 6.8 Medium
Published: Oct 29, 2026
Updated: Oct 30, 2026
Reserved: Sep 1, 2026

Description

Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	ProgressSoftware

Weaknesses

CWE-303 Incorrect Implementation of Authentication Algorithm
CWE-287 Improper Authentication

Affected Products

Product	Versions
WS_FTP ServerProgress Software	before 2024.0.6Affected before 2025.0.3Affected

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/viewvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.