CVE-2026-84295

Progress WS_FTP Server unauthenticated information disclosure in authentication

critical · 10.0

Fix listed

Progress WS_FTP Server

Published Oct 29, 2026, 15:45 UTC

Description

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Reported fixed versions

2024.0.6, 2025.0.3

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.