The highest, CVE-2026-115338 at CVSS 3.1 8.1, lets a network attacker intercept or alter unencrypted WS_FTP traffic. Progress fixed all three in the WS_FTP Server Service Pack for November 2026, version 2025.0.5. This follows our earlier coverage of WS_FTP Server credential exposure and code execution flaws.
What it allows
CVE-2026-115338: Insecure XFT Transport (CVSS 3.1 8.1)
CVE-2026-115338 is insufficient protection of communications in the XFT transport of WS_FTP Server before 2025.0.5, per the CVE record. Progress Software, the CNA, says a network attacker on an unencrypted connection can intercept sensitive information or modify requests.
The record describes the position as adversary-in-the-middle on an HTTP connection, which can capture credentials or alter requests in transit. See our adversary-in-the-middle entry for how this interception works.
Progress's own workaround is to disable HTTP access to the XFT service and configure clients for HTTPS only. It also calls for invalidating active sessions and rotating any credentials known to have travelled over HTTP.
CVE-2026-115341: Path Traversal in Thin Client Web Transfer (CVSS 3.1 7.7)
CVE-2026-115341 is improper access restriction in the Thin Client Web Transfer component of WS_FTP Server before 2025.0.5, per the CVE record. Progress says an authenticated FTP user can reach files outside their intended scope through path traversal.
Mateusz Mieczkowski (rexnets) is credited in the CVE record as the external finder. Progress's workaround restricts network access to the Thin Client Web Transfer HTTPS endpoint to trusted hosts, or disables Web Transfer where it is not required.
CISA's Vulnrichment program recorded a Stakeholder-Specific Vulnerability Categorization for this CVE, dated 9 November 2026. It lists exploitation as none, automatable as no and technical impact as partial.
CVE-2026-115339: Unauthenticated XFT Memory Exhaustion (CVSS 3.1 7.5)
CVE-2026-115339 is insufficient resource limits in the XFT service of WS_FTP Server before 2025.0.5, per the CVE record. Progress says an unauthenticated remote attacker can send requests that exhaust server memory and cause denial of service.
Niv Levy is credited in the CVE record as the external finder. Progress's workaround reduces the XFT service's message-size and array-size limits to the minimum your transfers need.
What CISA KEV Says About the Three Flaws
None of the three CVEs appears in the CISA Known Exploited Vulnerabilities catalog, version 2026.11.09, as of 10 November 2026. Our KEV glossary entry explains the catalog.
Who is affected
The CVE records list WS_FTP Server before 2025.0.5 on Windows as affected by all three flaws, and version 2025.0.5 as not affected. Progress published the fix in the WS_FTP Server Service Pack for November 2026.
Administrators who have not yet applied the Service Pack should treat all three flaws as present until they upgrade. Our patch management entry covers how to plan an update of this kind.
Timeline
- 22 Oct 2026
Progress Software reserves the CVE ids for all three flaws, per each CVE record.
- 9 Nov 2026
Progress publishes the CVE records for CVE-2026-115338, CVE-2026-115341 and CVE-2026-115339, and NVD publishes its entries the same day.
- 9 Nov 2026
CISA's Vulnrichment program records its Stakeholder-Specific Vulnerability Categorization for CVE-2026-115341.
What to do
-
Identify Every WS_FTP Server Install
List every WS_FTP Server instance and record its version. The CVE records list every version before 2025.0.5 as affected by at least one of the three flaws.
-
Apply the November 2026 Service Pack
Upgrade every instance to WS_FTP Server 2025.0.5, the version Progress lists as not affected by CVE-2026-115338, CVE-2026-115341 or CVE-2026-115339.
-
Restrict the XFT and Thin Client Web Transfer Endpoints Until You Patch
Progress's workarounds are to require HTTPS for the XFT service and rotate any HTTP-transmitted credentials, and to restrict Thin Client Web Transfer to trusted hosts or disable it. We recommend treating these as an interim step, not a substitute for the Service Pack.
-
Reduce XFT Resource Limits
Progress's workaround for CVE-2026-115339 is to reduce the XFT service's message-size and array-size limits to the minimum your transfers need.
-
Recheck the CISA KEV Catalog After You Patch
CISA KEV catalog version 2026.11.09 lists none of the three CVEs as of 10 November 2026. We recommend checking the catalog again later, since its contents can change.
Frequently Asked Questions
What versions of WS_FTP Server do CVE-2026-115338, CVE-2026-115341 and CVE-2026-115339 affect?
The CVE records list WS_FTP Server before 2025.0.5 on Windows as affected by all three flaws. Progress fixed them in the WS_FTP Server Service Pack for November 2026, version 2025.0.5.
What does CVE-2026-115338 let an attacker do?
Progress's CVE record says a network attacker on an unencrypted XFT connection can intercept sensitive information or modify requests, an adversary-in-the-middle position scored CVSS 3.1 8.1.
Can an unauthenticated attacker exploit CVE-2026-115341?
No. The CVE record requires an authenticated FTP user, who can then reach files outside their intended scope in Thin Client Web Transfer through path traversal, scored CVSS 3.1 7.7.
Does CVE-2026-115339 need authentication?
No. Progress's CVE record says an unauthenticated remote attacker can exhaust XFT service memory and cause denial of service, scored CVSS 3.1 7.5.
Are the three WS_FTP Server flaws in the CISA KEV catalog?
No. None of the three CVEs appears in the CISA Known Exploited Vulnerabilities catalog, version 2026.11.09, as of 10 November 2026.
Sources
- CVE-2026-115338 RecordCVE Program / Progress Software
- CVE-2026-115341 RecordCVE Program / Progress Software
- CVE-2026-115339 RecordCVE Program / Progress Software
- CVE-2026-115338NVD
- CVE-2026-115341NVD
- CVE-2026-115339NVD
- WS_FTP Server Service Pack (November 2026)Progress Software
- Known Exploited Vulnerabilities CatalogCISA
