Description
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | WS_FTP Server | < 2024.0.6, < 2025.0.3 | 2024.0.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
foxcornlab/wsftp-server-scanner ★ 0 · Nov 1, 2026
Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4240 Progress Software WS_FTP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026