Progress fixes five WS_FTP Server flaws exposing sensitive data

Progress Software has released an update in November 2026 that patches five high-severity flaws in Progress WS_FTP Server. The issues are tracked as CVE-2026-115338, CVE-2026-115339, CVE-2026-115340, CVE-2026-115341, and CVE-2026-35189, with CVSSv3 scores up to 8.1 for the XFT/HTTP transport and related components.

The advisory states the flaws allow file leaks, traffic snooping, and potential memory-related crashes, and notes that all five were addressed in WS_FTP Server 2025.0.5 and by updating OpenSSL to 3.5.9 in 2024.0.8 and 2025.0.5. The article emphasises that there is currently no confirmed exploitation in the wild for these vulnerabilities.

Affected versions include all WS_FTP Server for Windows builds prior to 2025.0.5 (10.0.5), with the OpenSSL memory issue (CVE-2026-35189) affecting builds prior to 2024.0.8 (9.0.8) that request client certificates.

Evidence cited includes reports from researchers Momen Elmady of Oxmatrix and Mateusz Mieczkowski of rexnets, with the vendor noting that “WS_FTP Server may write sensitive user credentials and session data to a temporary file,” a condition that could expose sensitive information, and warning of a potential outage during the upgrade.

The advisory also states that, if patching cannot occur immediately, administrators should mitigate by blocking HTTP on XFT, limiting Web Transfer to trusted hosts, and disabling client-cert requests. The report attributes these details to Progress Software and the referenced vulnerability disclosures.