Last checked against sources: 29 October 2026.
Progress has published nine CVE records for WS_FTP Server on Windows, including a CVSS 10.0 flaw that can expose administrative credentials without a login. Check the release line before choosing a fix. The later group affects versions below 2024.0.7 or 2025.0.4, while two earlier defects have lower patch thresholds.
These are WS_FTP Server vulnerabilities, not a claim about every WS_FTP desktop client. The vendor-authored CVE records were published on 29 October. Progress’s public version history dates 2025.0.4, also called 10.0.4, to 1 October. Today’s records do not mean the patch was released today.
Match the Fix to the Release Line
The two rows below preserve the year-labelled branches in Progress’s records. Updating only to the earlier boundary leaves the later group unresolved. Use a supported upgrade path for the server you operate rather than mixing the two branches.
| CVE Group | 2024 Line: Affected Below | 2025 Line: Affected Below |
|---|---|---|
| 84294 and 84295 | 2024.0.6 | 2025.0.3 |
| 90863 through 90869 | 2024.0.7 | 2025.0.4 |
In the next table, each short number has the prefix CVE-2026-. Low or high privileges refer to the account access in the CVSS 3.1 vector. A delegated Host Administrator has a defined scope; a defect that escapes it is a real access-boundary failure.
| CVE Suffix | CVSS | Access and Specific Impact |
|---|---|---|
| 84295 | 10.0 | No login, low complexity. Sensitive information, including administrative credentials, may be accessed. |
| 84294 | 7.7 | Low privileges. Ad Hoc Transfer can expose files outside intended directories. |
| 90863 | 9.1 | High privileges, delegated Host Administrator. Scope escape may allow elevated command execution and server compromise. |
| 90864 | 9.1 | High privileges, delegated Host Administrator. Files outside authorized scope may be accessed or changed. |
| 90865 | 9.0 | No login, high complexity, certain configurations. OS command injection may run with elevated privileges. |
| 90866 | 9.1 | High privileges, delegated Host Administrator. Access outside authorized paths may lead to remote code execution. |
| 90867 | 8.1 | No login, high complexity. The Web Admin console can expose administrative functionality to remote authentication attempts. |
| 90868 | 9.9 | Low privileges, low complexity, certain configurations. Arbitrary command execution. |
| 90869 | 7.5 | No login. Knowing an enrolled SSH public key may allow termination of the shared SSH service. |
Put the Build Check Before the Incident Review
For each server, record the actual build, its release line and which transfer or admin components are enabled. Assign the upgrade to that host’s owner. This is a concrete patch management task, not a reason to assume every component has the same exposure.
The following are defender review steps drawn from the disclosed risks. They are not claims of a confirmed compromise or a substitute for vendor fixes.
- Move to the maintained fixed release for your branch and confirm the deployed build after the change.
- Review unexpected administrator activity and files accessed outside a delegated administrator’s normal scope.
- Assess possible credential exposure under your incident process and rotate affected secrets where needed.
- Reduce unnecessary access to administration services while completing the upgrade. This is general exposure reduction, not a complete workaround.
Our file-transfer and remote-support attack review explains why this class of server deserves prompt attention. It is background, not evidence that these nine CVEs are in a ransomware campaign. The credential dump explainer helps distinguish exposed access from a confirmed account takeover.
Keep the Configuration Gap Visible
The CVE records say certain configurations affect the two command-injection paths. The linked Progress knowledge-base page did not return readable advisory text during this check. The exact settings behind that condition therefore remain unconfirmed here; we do not supply an inferred workaround or test request.
- CISA KEVNot seenThese nine CVEs were not listed in the checked catalogue. This is not proof of no attacks.29 October 2026
- Confirmed attacksUnknownThe opened primary records do not establish an active exploitation campaign.29 October 2026
Complete the build check and obtain the full advisory through Progress support if your configuration needs clarification. Preserve relevant logs while reviewing access. Avoid calling credential exposure a proven remote-code-execution chain unless evidence supports each step.