Search
Find a vulnerability
Search criteria
30 vulnerabilities found for WS_FTP Server by Progress Software
CVE-2026-90872 (GCVE-0-2026-90872)
Vulnerability from nvd – Published: 2026-10-29 15:57 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Summary
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:42.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process."
}
],
"value": "Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Code Injection - allows execution of arbitrary JScript and OS commands in the IIS worker process"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:57:24.826Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90872",
"datePublished": "2026-10-29T15:57:24.826Z",
"dateReserved": "2026-09-14T06:10:05.561Z",
"dateUpdated": "2026-10-30T03:56:42.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90871 (GCVE-0-2026-90871)
Vulnerability from nvd – Published: 2026-10-29 15:56 – Updated: 2026-10-29 15:56
VLAI
EPSS
VEX
Title
Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Summary
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Momen Elmady (0xmatrix)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory."
}
],
"value": "Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - could allow file deletion outside intended directory boundaries, subject to the affected account\u2019s permissions."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:56:34.762Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eBy default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "By default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90871",
"datePublished": "2026-10-29T15:56:34.762Z",
"dateReserved": "2026-09-14T06:10:04.370Z",
"dateUpdated": "2026-10-29T15:56:34.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90870 (GCVE-0-2026-90870)
Vulnerability from nvd – Published: 2026-10-29 15:55 – Updated: 2026-10-29 15:55
VLAI
EPSS
VEX
Title
Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
Summary
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."
}
],
"value": "A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Excessive Allocation - repeated unauthenticated requests retain backend sessions and cause resource exhaustion and service degradation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-772",
"description": "CWE-772: Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:55:43.950Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eShorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90870",
"datePublished": "2026-10-29T15:55:43.950Z",
"dateReserved": "2026-09-14T06:09:55.848Z",
"dateUpdated": "2026-10-29T15:55:43.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90869 (GCVE-0-2026-90869)
Vulnerability from nvd – Published: 2026-10-29 15:54 – Updated: 2026-10-29 15:54
VLAI
EPSS
VEX
Title
Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
Summary
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Severity
7.5 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote attacker who knows a valid account\u0027s enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows."
}
],
"value": "A remote attacker who knows a valid account\u0027s enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Overread Buffers - Improper handling of input data could result in denial of service."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:54:48.769Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict network access to the SSH/SFTP service to trusted clients and disable SSH/SFTP access if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict network access to the SSH/SFTP service to trusted clients and disable SSH/SFTP access if it is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90869",
"datePublished": "2026-10-29T15:54:48.769Z",
"dateReserved": "2026-09-14T06:09:55.848Z",
"dateUpdated": "2026-10-29T15:54:48.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90868 (GCVE-0-2026-90868)
Vulnerability from nvd – Published: 2026-10-29 15:53 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
OS Command Injection in Progress WS_FTP Server
Summary
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:42.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yash Kumar Kumawat (ykk0x)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations."
}
],
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection - allows injection of shell operators and execution of arbitrary commands"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:53:59.315Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90868",
"datePublished": "2026-10-29T15:53:59.315Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:42.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90867 (GCVE-0-2026-90867)
Vulnerability from nvd – Published: 2026-10-29 15:53 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Improper Access Control of Web Admin Console in Progress WS_FTP Server
Summary
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:41.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts."
}
],
"value": "Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels - allows access to functionality that should be restricted to a higher-privileged administrative role"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:53:12.203Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Access Control of Web Admin Console in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90867",
"datePublished": "2026-10-29T15:53:12.203Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:41.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90866 (GCVE-0-2026-90866)
Vulnerability from nvd – Published: 2026-10-29 15:52 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
Summary
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:40.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."
}
],
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow a delegated administrator to escape their assigned host root and achieve remote code execution"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:52:24.790Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Virtual Folder Path Confinement Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90866",
"datePublished": "2026-10-29T15:52:24.790Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:40.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90865 (GCVE-0-2026-90865)
Vulnerability from nvd – Published: 2026-10-29 15:51 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Command Injection via FTP Notification Variables in Progress WS_FTP Server
Summary
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:39.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mieczkowski Mateusz (rexnets)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations."
}
],
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection - allows execution of arbitrary commands with LocalSystem privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:51:35.058Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Command Injection via FTP Notification Variables in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90865",
"datePublished": "2026-10-29T15:51:35.058Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:39.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90864 (GCVE-0-2026-90864)
Vulnerability from nvd – Published: 2026-10-29 15:50 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Host Administrator Path Containment Bypass in Progress WS_FTP Server
Summary
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:39.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."
}
],
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow access to or modification of files outside authorized directory boundaries"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:50:29.084Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Host Administrator Path Containment Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90864",
"datePublished": "2026-10-29T15:50:29.084Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:39.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90863 (GCVE-0-2026-90863)
Vulnerability from nvd – Published: 2026-10-29 15:49 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Privilege Escalation via Missing Authorization in WS_FTP Manager
Summary
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:38.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server."
}
],
"value": "Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Parameter Injection - manipulation of input parameters to perform actions beyond the user\u0027s authorized scope."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:49:34.111Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation via Missing Authorization in WS_FTP Manager",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegation of the Host Administrator role to trusted staff, and review existing Host Administrator accounts and their setting\u0027s scope and permissions. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegation of the Host Administrator role to trusted staff, and review existing Host Administrator accounts and their setting\u0027s scope and permissions. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90863",
"datePublished": "2026-10-29T15:49:34.111Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:38.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90862 (GCVE-0-2026-90862)
Vulnerability from nvd – Published: 2026-10-29 15:48 – Updated: 2026-10-29 15:48
VLAI
EPSS
VEX
Title
Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Summary
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
Severity
4.3 (Medium)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tanishq Shah (tanishqshah)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."
}
],
"value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse - allows file downloads from a pending multi-factor authentication session"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-308",
"description": "CWE-308: Use of Single-factor Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:48:42.885Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90862",
"datePublished": "2026-10-29T15:48:42.885Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-29T15:48:42.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90861 (GCVE-0-2026-90861)
Vulnerability from nvd – Published: 2026-10-29 15:47 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:37.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user\u0027s password in clear text to another administrator, who could use it to gain broader administrative access to the server."
}
],
"value": "Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user\u0027s password in clear text to another administrator, who could use it to gain broader administrative access to the server."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Collect Data from Common Resource Locations - sensitive password-change arguments are stored in logs and disclosed to a lower-privileged delegated administrator"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:47:45.075Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90861",
"datePublished": "2026-10-29T15:47:45.075Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:37.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84296 (GCVE-0-2026-84296)
Vulnerability from nvd – Published: 2026-10-29 15:46 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Summary
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:36.814Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tanishq Shah (tanishqshah)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts."
}
],
"value": "Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse - bypasses multi-factor authentication through improper cross-account association of authentication factors"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303: Incorrect Implementation of Authentication Algorithm",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:46:44.924Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThere are no workarounds that address this vulnerability.\u003c/div\u003e"
}
],
"value": "There are no workarounds that address this vulnerability."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84296",
"datePublished": "2026-10-29T15:46:44.924Z",
"dateReserved": "2026-09-01T16:14:47.719Z",
"dateUpdated": "2026-10-30T03:56:36.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84295 (GCVE-0-2026-84295)
Vulnerability from nvd – Published: 2026-10-29 15:45 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Improper Authentication in Progress WS_FTP Server
Summary
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:36.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luu Tien Thanh (thalu93)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials."
}
],
"value": "Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Authentication Bypass - may enable further compromise of the affected WS_FTP Server"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:45:08.601Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84295",
"datePublished": "2026-10-29T15:45:08.601Z",
"dateReserved": "2026-09-01T16:14:46.568Z",
"dateUpdated": "2026-10-30T03:56:36.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84294 (GCVE-0-2026-84294)
Vulnerability from nvd – Published: 2026-10-29 15:42 – Updated: 2026-10-29 15:43
VLAI
EPSS
VEX
Title
Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Summary
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
Severity
7.7 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories."
}
],
"value": "Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow access to files outside intended directories"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:43:29.463Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts.\u003c/div\u003e"
}
],
"value": "Restrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84294",
"datePublished": "2026-10-29T15:42:44.195Z",
"dateReserved": "2026-09-01T16:14:45.351Z",
"dateUpdated": "2026-10-29T15:43:29.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90872 (GCVE-0-2026-90872)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:57 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Summary
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:42.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process."
}
],
"value": "Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Code Injection - allows execution of arbitrary JScript and OS commands in the IIS worker process"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:57:24.826Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90872",
"datePublished": "2026-10-29T15:57:24.826Z",
"dateReserved": "2026-09-14T06:10:05.561Z",
"dateUpdated": "2026-10-30T03:56:42.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90871 (GCVE-0-2026-90871)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:56 – Updated: 2026-10-29 15:56
VLAI
EPSS
VEX
Title
Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Summary
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Momen Elmady (0xmatrix)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory."
}
],
"value": "Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - could allow file deletion outside intended directory boundaries, subject to the affected account\u2019s permissions."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:56:34.762Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eBy default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "By default the affected anonymous account can only delete files it previously created; ensure it is not granted broader write/delete permissions than required on Ad Hoc Transfer and Web Transfer related directories. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90871",
"datePublished": "2026-10-29T15:56:34.762Z",
"dateReserved": "2026-09-14T06:10:04.370Z",
"dateUpdated": "2026-10-29T15:56:34.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90870 (GCVE-0-2026-90870)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:55 – Updated: 2026-10-29 15:55
VLAI
EPSS
VEX
Title
Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
Summary
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
Severity
5.3 (Medium)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."
}
],
"value": "A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Excessive Allocation - repeated unauthenticated requests retain backend sessions and cause resource exhaustion and service degradation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-772",
"description": "CWE-772: Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:55:43.950Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eShorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90870",
"datePublished": "2026-10-29T15:55:43.950Z",
"dateReserved": "2026-09-14T06:09:55.848Z",
"dateUpdated": "2026-10-29T15:55:43.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90869 (GCVE-0-2026-90869)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:54 – Updated: 2026-10-29 15:54
VLAI
EPSS
VEX
Title
Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
Summary
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Severity
7.5 (High)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote attacker who knows a valid account\u0027s enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows."
}
],
"value": "A remote attacker who knows a valid account\u0027s enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Overread Buffers - Improper handling of input data could result in denial of service."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:54:48.769Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict network access to the SSH/SFTP service to trusted clients and disable SSH/SFTP access if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict network access to the SSH/SFTP service to trusted clients and disable SSH/SFTP access if it is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90869",
"datePublished": "2026-10-29T15:54:48.769Z",
"dateReserved": "2026-09-14T06:09:55.848Z",
"dateUpdated": "2026-10-29T15:54:48.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90868 (GCVE-0-2026-90868)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:53 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
OS Command Injection in Progress WS_FTP Server
Summary
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:42.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yash Kumar Kumawat (ykk0x)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations."
}
],
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection - allows injection of shell operators and execution of arbitrary commands"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:53:59.315Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS Command Injection in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90868",
"datePublished": "2026-10-29T15:53:59.315Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:42.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90867 (GCVE-0-2026-90867)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:53 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Improper Access Control of Web Admin Console in Progress WS_FTP Server
Summary
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:41.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts."
}
],
"value": "Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels - allows access to functionality that should be restricted to a higher-privileged administrative role"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:53:12.203Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Access Control of Web Admin Console in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90867",
"datePublished": "2026-10-29T15:53:12.203Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:41.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90866 (GCVE-0-2026-90866)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:52 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
Summary
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:40.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."
}
],
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow a delegated administrator to escape their assigned host root and achieve remote code execution"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:52:24.790Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Virtual Folder Path Confinement Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegation of Host Administrator privileges to trusted staff, and periodically audit virtual folder physical paths to confirm they remain within their assigned host root. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90866",
"datePublished": "2026-10-29T15:52:24.790Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:40.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90865 (GCVE-0-2026-90865)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:51 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Command Injection via FTP Notification Variables in Progress WS_FTP Server
Summary
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:39.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mieczkowski Mateusz (rexnets)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations."
}
],
"value": "An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "OS Command Injection - allows execution of arbitrary commands with LocalSystem privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:51:35.058Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Command Injection via FTP Notification Variables in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90865",
"datePublished": "2026-10-29T15:51:35.058Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:39.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90864 (GCVE-0-2026-90864)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:50 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Host Administrator Path Containment Bypass in Progress WS_FTP Server
Summary
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:39.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."
}
],
"value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow access to or modification of files outside authorized directory boundaries"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:50:29.084Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Host Administrator Path Containment Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90864",
"datePublished": "2026-10-29T15:50:29.084Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:39.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90863 (GCVE-0-2026-90863)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:49 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Privilege Escalation via Missing Authorization in WS_FTP Manager
Summary
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:38.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server."
}
],
"value": "Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Parameter Injection - manipulation of input parameters to perform actions beyond the user\u0027s authorized scope."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:49:34.111Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Privilege Escalation via Missing Authorization in WS_FTP Manager",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eLimit delegation of the Host Administrator role to trusted staff, and review existing Host Administrator accounts and their setting\u0027s scope and permissions. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Limit delegation of the Host Administrator role to trusted staff, and review existing Host Administrator accounts and their setting\u0027s scope and permissions. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90863",
"datePublished": "2026-10-29T15:49:34.111Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:38.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90862 (GCVE-0-2026-90862)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:48 – Updated: 2026-10-29 15:48
VLAI
EPSS
VEX
Title
Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Summary
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
Severity
4.3 (Medium)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tanishq Shah (tanishqshah)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."
}
],
"value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse - allows file downloads from a pending multi-factor authentication session"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-308",
"description": "CWE-308: Use of Single-factor Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:48:42.885Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90862",
"datePublished": "2026-10-29T15:48:42.885Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-29T15:48:42.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90861 (GCVE-0-2026-90861)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:47 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.7
(custom)
Affected: 0 , < 2025.0.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90861",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:37.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user\u0027s password in clear text to another administrator, who could use it to gain broader administrative access to the server."
}
],
"value": "Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user\u0027s password in clear text to another administrator, who could use it to gain broader administrative access to the server."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Collect Data from Common Resource Locations - sensitive password-change arguments are stored in logs and disclosed to a lower-privileged delegated administrator"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:47:45.075Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Restrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-90861",
"datePublished": "2026-10-29T15:47:45.075Z",
"dateReserved": "2026-09-14T06:09:55.847Z",
"dateUpdated": "2026-10-30T03:56:37.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84296 (GCVE-0-2026-84296)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:46 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Summary
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:36.814Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tanishq Shah (tanishqshah)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts."
}
],
"value": "Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse - bypasses multi-factor authentication through improper cross-account association of authentication factors"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303: Incorrect Implementation of Authentication Algorithm",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:46:44.924Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThere are no workarounds that address this vulnerability.\u003c/div\u003e"
}
],
"value": "There are no workarounds that address this vulnerability."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84296",
"datePublished": "2026-10-29T15:46:44.924Z",
"dateReserved": "2026-09-01T16:14:47.719Z",
"dateUpdated": "2026-10-30T03:56:36.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84295 (GCVE-0-2026-84295)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:45 – Updated: 2026-10-30 03:56
VLAI
EPSS
VEX
Title
Improper Authentication in Progress WS_FTP Server
Summary
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 00:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T03:56:36.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luu Tien Thanh (thalu93)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials."
}
],
"value": "Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Authentication Bypass - may enable further compromise of the affected WS_FTP Server"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:45:08.601Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eContact Progress Software Technical Support for guidance on available mitigations.\u003c/div\u003e"
}
],
"value": "Contact Progress Software Technical Support for guidance on available mitigations."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84295",
"datePublished": "2026-10-29T15:45:08.601Z",
"dateReserved": "2026-09-01T16:14:46.568Z",
"dateUpdated": "2026-10-30T03:56:36.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84294 (GCVE-0-2026-84294)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:42 – Updated: 2026-10-29 15:43
VLAI
EPSS
VEX
Title
Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Summary
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
Severity
7.7 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://progress.lightning.force.com/lightning/r/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | WS_FTP Server |
Affected:
0 , < 2024.0.6
(custom)
Affected: 0 , < 2025.0.3 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "WS_FTP Server",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "2024.0.6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2025.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Levy (restricted)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories."
}
],
"value": "Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Path Traversal - may allow access to files outside intended directories"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:43:29.463Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eRestrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts.\u003c/div\u003e"
}
],
"value": "Restrict Ad Hoc Transfer functionality to trusted users, or disable it if not required. Apply least-privilege permissions to relevant service accounts."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-84294",
"datePublished": "2026-10-29T15:42:44.195Z",
"dateReserved": "2026-09-01T16:14:45.351Z",
"dateUpdated": "2026-10-29T15:43:29.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}