Paper/Archive/CVE-2026-84295

CVE-2026-84295

Progress Software WS_FTP Server — Improper Authentication in Progress WS_FTP Server

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Affected

ProductAffectedFixed inSource

WS_FTP Server< 2024.0.62024.0.6CNA

WS_FTP Server< 2025.0.32025.0.3CNA

Scores by source

ProgressSoftware (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryprogress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view