Skip to content
OpenAdvisories

Product · Progress Software

WS_FTP Server

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-90868

    OS Command Injection in Progress WS_FTP Server

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90866

    Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

    Progress Software WS_FTP Server
  • Critical 9.0
    CVE-2026-90865

    Command Injection via FTP Notification Variables in Progress WS_FTP Server

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90864

    Host Administrator Path Containment Bypass in Progress WS_FTP Server

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2026-90863

    Privilege Escalation via Missing Authorization in WS_FTP Manager

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exe…

    Progress Software WS_FTP Server
  • Critical 10.0
    CVE-2026-84295 Public exploit

    Improper Authentication in Progress WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

    Progress Software WS_FTP Server
  • Critical 9.1
    CVE-2023-42659

    WS_FTP Server Arbitrary File Upload

    In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying o…

    Progress Software WS_FTP Server
  • Critical 9.9
    CVE-2023-42657 EPSS 16%

    WS_FTP Server Directory Traversal

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized W…

    Progress Software WS_FTP Server
  • Critical 10.0
    CVE-2023-40044 Exploited · Ransomware Public exploit EPSS 90%

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Progress Software WS_FTP Server
    KEV Oct 5, 2023