Progress patches 15 WS_FTP Server flaws, including CVE-2026-84295

Progress Software released security updates addressing 15 WS_FTP Server vulnerabilities on 29 October 2026. The most severe flaw, CVE-2026-84295, carries a maximum 10.0 CVSS score and allows unauthenticated attackers to access administrative credentials, potentially enabling a full takeover of the management console. The vendor notes that affected builds prior to 2024.0.6 and 2025.0.3 are at risk, and organisations should apply the latest service releases immediately.

The advisory also lists a mix of other high- and medium-severity issues, but notes that no exploitation in the wild has been confirmed at the time of reporting.

The advisory details authentication and input-validation weaknesses across WS_FTP Server’s web and transfer components, including critical OS command-injection flaws tracked as CVE-2026-90868 (CVSS 9.9) and CVE-2026-90865 (CVSS 9.0) affecting Windows, which could allow arbitrary command execution under certain configurations.

Additional path traversal and authorization gaps, such as CVE-2026-90863 (CVSS 9.1) and CVE-2026-90864 / CVE-2026-90866 (CVSS 9.1 each), could let a delegated Host Administrator exceed their access or modify files. Other listed issues cover multi-factor authentication bypasses (CVE-2026-84296 and CVE-2026-90862), DoS vectors (CVE-2026-90869/90870), and cleartext password leaks (CVE-2026-90861).

Affected versions are Windows, with CVEs 84294, 84295, and 84296 impacting versions prior to 2024.0.6 and 2025.0.3; the remaining twelve vulnerabilities affect prior to 2024.0.7 and 2025.0.4. Progress Software’s patch guidance directs upgrading to 2024.0.7 and 2025.0.4, or restricting administrative web consoles if immediate upgrade isn’t feasible.