WS_FTP Server at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 6 | 0 |
| Oct 2026 | 15 | 6 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
32 results · Feed
-
High 7.1
Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
-
High 7.5
Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.
-
High 7.7
Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
-
Medium 6.3
Folder Permission Bypass in Progress WS_FTP Server
Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
-
Medium 6.5
FTP Quota Accounting Bypass in Progress WS_FTP Server
Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.
-
High 8.1
Insecure XFT Transport in Progress WS_FTP Server
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
-
Medium 6.6
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary comman…
-
Medium 5.3
Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
-
Medium 5.3
Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
-
High 7.5
Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
-
Critical 9.9
OS Command Injection in Progress WS_FTP Server
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
-
High 8.1
Improper Access Control of Web Admin Console in Progress WS_FTP Server
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
-
Critical 9.1
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
-
Critical 9.0
Command Injection via FTP Notification Variables in Progress WS_FTP Server
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
-
Critical 9.1
Host Administrator Path Containment Bypass in Progress WS_FTP Server
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
-
Critical 9.1
Privilege Escalation via Missing Authorization in WS_FTP Manager
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exe…
-
Medium 4.3
Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying mul…
-
Medium 6.6
Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
-
Medium 6.8
SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication facto…
-
Critical 10.0CVE-2026-84295 Public exploit
Improper Authentication in Progress WS_FTP Server
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
-
High 7.7
Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
-
Medium 6.5
Multi-Factor Authentication Bypass in Progress WS_FTP Server
In WS_FTP Server versions before 8.8.9 (2022.0.9), an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.
-
Medium 6.5
Multi-Factor Authentication Bypass in Progress WS_FTP Server
In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.
-
Medium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server
In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal. …
-
Critical 9.1
WS_FTP Server Arbitrary File Upload
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying o…
-
Medium 5.3
WS_FTP Server Information Disclosure via Directory Listing
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.
-
Medium 6.8
WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.
-
High 8.3
WS_FTP Server Stored Cross-Site Scripting Vulnerability
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site s…
-
High 8.2
WS_FTP Server SQL Injection via Administrative Interface
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…
-
High 8.3
WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …
-
Critical 9.9CVE-2023-42657 EPSS 16%
WS_FTP Server Directory Traversal
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized W…
-
Critical 10.0
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
KEV Oct 5, 2023