Progress discloses critical WS_FTP Server flaws fixed weeks ago

Progress discloses critical WS_FTP Server flaws fixed weeks ago

2 November 2026: Progress Software has published six critical vulnerabilities in WS_FTP Server for Windows, led by CVE-2026-84295, rated 10.0, which lets an unauthenticated remote attacker read "sensitive information, including administrative credentials". The CVE records went up on 29 October, but the fixes shipped earlier: WS_FTP Server 2025.0.3 on 3 September and 2025.0.4 on 1 October, with matching 2024.0.6 and 2024.0.7 releases on the older line.

Not yet independently verified. Progress's own security bulletin did not load for us; the flaws, scores and fixed versions here come from Progress's CVE records, and the full list of 15 is as heise reported it. We will update this when it can be confirmed, and remove this note.

A server patched in October is already safe. One still on an older build now has published flaw descriptions to be attacked against.

Six flaws rated 9.0 or higher

All six are on Windows installations only, according to Progress's records:

• CVE-2026-84295 (10.0): improper authentication exposes administrative credentials to an attacker who is not logged in. Fixed in 2025.0.3 and 2024.0.6.
• CVE-2026-90868 (9.9): OS command injection that "could allow arbitrary command execution under certain configurations".
• CVE-2026-90866 and CVE-2026-90864 (9.1 each): path traversal that lets a delegated Host Administrator reach or change files outside the folders they are meant to manage.
• CVE-2026-90863 (9.1): missing authorisation in the WS_FTP Manager administrative interface lets a delegated Host Administrator exceed their scope, "potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server".
• CVE-2026-90865 (9.0): command injection through FTP notification variables, running with elevated privileges.

The last five are fixed in 2025.0.4 and 2024.0.7. heise counts 15 flaws in the bulletin in all, the rest rated from 4.3 to 8.1, among them an SSH multi-factor authentication bypass (CVE-2026-84296, 6.8) fixed in 2025.0.3.

Why delegated administrators matter here

Three of the critical flaws need an account, but not a powerful one. WS_FTP lets a company hand a Host Administrator control of one site or customer on a shared server. Those flaws let that limited administrator break out to the whole server and, in two cases, run commands on it. Hosting providers and companies that give partners their own administrator logins carry the most exposure.

Checking a WS_FTP server

The version number in WS_FTP Manager tells you whether you are safe: 2025.0.4 or later on the 2025 line, 2024.0.7 or later on the 2024 line. Anything older needs the upgrade, and any server reachable from the internet before the October release is worth a look at its administrator accounts, since CVE-2026-84295 exposes their credentials.

WS_FTP is a managed file transfer product, the category hit hardest by mass exploitation in recent years. None of these flaws was on CISA's Known Exploited Vulnerabilities catalogue when we checked on 2 November, and Progress's records report no exploitation.

Sources

• Progress Software: CVE-2026-84295 record (CNA), 29 October 2026
• Progress Software: CVE-2026-90868 record (CNA), 29 October 2026
• Progress Software: CVE-2026-90863 record (CNA), 29 October 2026
• Progress Software: What's new in WS_FTP Server 2025 (read 2026-11-02), 2 November 2026
• heise online: Sicherheitslücken in Progress WS_FTP ermöglichen Kompromittierung, 2 November 2026