Skip to content
OpenAdvisories
High WID-SEC-2026-4240 15 CVEs

Progress Software WS_FTP: Mehrere Schwachstellen

Published Oct 29, 2026 · Updated Oct 29, 2026 · de-DE

Vendor: Progress Software Product: WS_FTP Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Progress Software WS_FTP ausnutzen, um seine Berechtigungen zu erweitern und sich möglicherweise Administratorrechte zu verschaffen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

WS_FTP ist eine FTP (File Transfer Protocol) Software, die zur Übertragung von Dateien zwischen einem Client und einem Server über das Internet verwendet wird.

Vulnerabilities 15

  • Critical 10.0
    CVE-2026-84295 Public exploit

    Improper Authentication in Progress WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

    Progress Software WS_FTP Server
  • Critical 9.9
    CVE-2026-90868

    OS Command Injection in Progress WS_FTP Server

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90863

    Privilege Escalation via Missing Authorization in WS_FTP Manager

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exe…

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90864

    Host Administrator Path Containment Bypass in Progress WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90866

    Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

    Progress Software WS_FTP Server
  • Critical 9.0
    CVE-2026-90865

    Command Injection via FTP Notification Variables in Progress WS_FTP Server

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

    Progress Software WS_FTP Server
  • High 8.1
    CVE-2026-90867

    Improper Access Control of Web Admin Console in Progress WS_FTP Server

    Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

    Progress Software WS_FTP Server
  • High 7.7
    CVE-2026-84294

    Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

    Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

    Progress Software WS_FTP Server
  • High 7.5
    CVE-2026-90869

    Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

    A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

    Progress Software WS_FTP Server
  • Medium 6.8
    CVE-2026-84296

    SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server

    Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication facto…

    Progress Software WS_FTP Server
  • Medium 6.6
    CVE-2026-90861

    Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

    Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

    Progress Software WS_FTP Server
  • Medium 6.6
    CVE-2026-90872

    Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

    Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary comman…

    Progress Software WS_FTP Server
  • Medium 5.3
    CVE-2026-90870

    Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

    A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

    Progress Software WS_FTP Server
  • Medium 5.3
    CVE-2026-90871

    Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

    Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.

    Progress Software WS_FTP Server
  • Medium 4.3
    CVE-2026-90862

    Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

    Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying mul…

    Progress Software WS_FTP Server

Revision history

  1. #1

    Initiale Fassung

References