CVE-2026-84295

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3…

Risk score: 65/100
CVSS: 10.0 v3.1
Published: 29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows have an improper authentication flaw, allowing an unauthenticated remote attacker to access sensitive information.
Affected: {'products': ['WS_FTP Server'], 'packages': [], 'versions': ['prior to 2024.0.6', 'prior to 2025.0.3']}
Fix: Upgrade to version 2024.0.6 or later, or version 2025.0.3 or later
Exploitation: No known exploitation

Why it is Amber

CVSS 10.0 critical
Remotely exploitable without logging in

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

Original description

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Last activity 29 Oct 2026. Patch Forecast updates every hour.