Progress WS_FTP Server CVE-2026-84295 and CVE-2026-90868: Critical Flaws Fixed in 2024.0.7 and 2025.0.4

On 29 October 2026, Progress Software published CVE records for two critical vulnerabilities in WS_FTP Server, its Windows file transfer server. CVE-2026-84295 is an improper authentication flaw that, according to Progress, "could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials" (CVE-2026-84295 record). CVE-2026-90868 is an OS command injection flaw that "could allow arbitrary command execution under certain configurations" (CVE-2026-90868 record). Progress, acting as the CVE Numbering Authority, rates them CVSS 3.1 10.0 and 9.9, both Critical.

The fixes are not new. WS_FTP Server 2024.0.6 and 2025.0.3, released on 3 September 2026, fix CVE-2026-84295. WS_FTP Server 2024.0.7 and 2025.0.4, released on 1 October 2026, fix CVE-2026-90868. The fixed versions come from Progress's CVE records; the release dates come from Progress's release notes (WS_FTP Server 2025 release notes; WS_FTP Server 2024 release notes). What changed on 29 October is that the details became public. A server that never took the September and October service packs is now running with publicly described critical flaws.

As of 29 October 2026, CVE-2026-84295 and CVE-2026-90868 are not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and we found no report that either has been exploited.

WS_FTP Server is often the system a company uses to swap files with customers, suppliers and service providers. That makes this a question for your file-exchange partners as well as your own IT team.

Technical Information

CVE-2026-84295: improper authentication (CVSS 10.0). Progress classifies this flaw as CWE-287 (Improper Authentication) and CWE-522 (Insufficiently Protected Credentials). Its CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no account and no user interaction needed. Progress describes the impact as an authentication bypass that "may enable further compromise of the affected WS_FTP Server." Progress has not published further technical detail. It credits Luu Tien Thanh with reporting the flaw.

CVE-2026-90868: OS command injection (CVSS 9.9). Progress classifies this flaw as CWE-78 (OS Command Injection) and CWE-88 (Argument Injection), and describes the impact as allowing "injection of shell operators and execution of arbitrary commands." Its CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The PR:L part matters: the attacker needs a low-privilege account on the server, so this is not an unauthenticated flaw. Progress says it applies "under certain configurations" but does not say which. Progress credits Yash Kumar Kumawat with reporting it.

Why the pair matters together (Rescana guidance). One flaw can reveal credentials, including administrator credentials, without logging in. The other lets a logged-in user run commands. No source we checked describes the two being used together, and we do not claim they can be. Still, a server missing both service packs should be treated as fully exposed, and its credentials should be treated as possibly exposed too.

The wider batch. On the same day, Progress published 13 more WS_FTP Server CVEs, all fixed in the same service packs. Four more are rated Critical by Progress. Three of those need a delegated Host Administrator account. The fourth, CVE-2026-90865 (9.0), is a command injection through FTP notification variables that Progress rates as harder to exploit and limited to certain configurations. The full list is in the table below.

Exploitation status. Progress has not reported exploitation, and neither has CISA, NVD or any other source we checked. Both CVEs are not in CISA KEV (catalog version 2026.10.28, checked 29 October 2026). NVD lists both records as "Awaiting Analysis," with only Progress's scores (NVD CVE-2026-84295; NVD CVE-2026-90868). We found no public exploit code and do not link to any.

Timeline (Cyprus time):

• 3 September 2026: WS_FTP Server 2024.0.6 (9.0.6) and 2025.0.3 (10.0.3) released [Progress release notes].
• 1 October 2026: WS_FTP Server 2024.0.7 (9.0.7) and 2025.0.4 (10.0.4) released [Progress release notes].
• 23 October 2026: WS_FTP Server 2024 (9.0) moves from Active to Sunset support [Progress product lifecycle].
• 29 October 2026, 17:42–17:57: Progress publishes 15 WS_FTP Server CVE records, including CVE-2026-84295 (17:45) and CVE-2026-90868 (17:53) [CVE Program].
• 29 October 2026, about 18:20: NVD lists both records as "Awaiting Analysis" [NVD].
• 29 October 2026: Not in CISA KEV.

The release-note "Fixed Issues" pages for these service packs do not name the CVEs, so teams that applied them may not have known they were closing security flaws (Fixed Issues 2025.0.3; Fixed Issues 2025.0.4).

Affected Product Versions

One target covers both: 2024.0.7 or 2025.0.4 or later. Progress lists Windows as the affected platform for both CVEs.

Older versions have no fix, and the 2024 line has left active support. Progress's WS_FTP product lifecycle page shows WS_FTP Server 2022 (8.8) as Retired since 4 July 2026. It also shows WS_FTP Server 2024 (9.0) moving from Active to Sunset on 23 October 2026, and Progress says it provides "no service packs or hot fixes" for versions in the Sunset phase. WS_FTP Server 2025 (10.0) stays in Active support until 10 December 2027. A server on 2022.x or older must move to a supported release line to get these fixes. 2024.0.7 closes both CVEs, but teams on the 2024 line should plan a move to 2025.0 to keep receiving fixes.

The other WS_FTP Server CVEs Progress published on 29 October 2026, with Progress's CVSS 3.1 scores from the CVE records:

Workaround and Mitigation

1. Upgrade to WS_FTP Server 2024.0.7 or 2025.0.4 or later. This fixes both CVEs and the rest of the 29 October batch. Progress has not published a configuration workaround for either CVE. For both, its CVE records say: "Contact Progress Software Technical Support for guidance on available mitigations."
2. Move unsupported servers. If you run WS_FTP Server 2022.x or older, move to a supported release. Progress no longer patches those versions. The 2024 (9.0) line entered Sunset on 23 October 2026, and Progress provides no service packs for Sunset versions, so 2025.0 is the line that will keep getting fixes.
3. Rotate credentials after upgrading (Rescana guidance). CVE-2026-84295 can expose administrator credentials. On any server that ran a version before 2024.0.6 or 2025.0.3 while reachable from untrusted networks, change WS_FTP administrator passwords and any service-account or database credentials the server stores. Then review the administrator accounts for any you did not create.
4. Keep the admin consoles off the internet. For the related CVE-2026-90867 and CVE-2026-90872, Progress advises limiting the Web Admin and Manager consoles to trusted administrative hosts and networks. That is good practice for this whole batch (Rescana guidance).
5. Turn off what you do not use. In its workarounds for the related CVEs, Progress advises limiting Ad Hoc Transfer, the Web Transfer Module and SSH/SFTP to the users and networks that need them, and disabling them where they are not required. It also advises limiting delegated Host Administrator rights to trusted staff.
6. Check servers that were behind on patches (Rescana guidance). No exploitation has been reported. Even so, on a server that missed both service packs, look in the logs for unexpected administrator logins, new or changed accounts, and processes started by the WS_FTP Server service that you cannot explain.

Indicators of Compromise

Progress has not published indicators of compromise for these CVEs, and we have none to add. No exploitation has been reported. No source we checked maps these flaws to MITRE ATT&CK techniques, and we have not done so.

What we will update

We will update this post if CISA adds CVE-2026-84295, CVE-2026-90868 or a related CVE to KEV, if Progress publishes a security bulletin or more technical detail, if NVD completes its analysis, if a national CERT issues guidance, or if credible reports of exploitation appear.

Sources

• Progress Software (CVE Numbering Authority), CVE records: CVE-2026-84295: https://www.cve.org/CVERecord?id=CVE-2026-84295; CVE-2026-90868: https://www.cve.org/CVERecord?id=CVE-2026-90868
• Progress Software, release notes: What's New in WS_FTP Server 2025: https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html; What's New in WS_FTP Server 2024: https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html; Fixed Issues 2025.0.3: https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Fixed-Issues-2025.0.3.html; Fixed Issues 2025.0.4: https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Fixed-Issues-2025.0.4.html
• Progress Software, support: WS_FTP product lifecycle: https://community.progress.com/s/products/ws-ftp/product-lifecycle
• NVD: CVE-2026-84295: https://nvd.nist.gov/vuln/detail/CVE-2026-84295; CVE-2026-90868: https://nvd.nist.gov/vuln/detail/CVE-2026-90868 (both "Awaiting Analysis," 29 October 2026)
• CISA: both CVEs not in the KEV catalog as of catalog version 2026.10.28, checked 29 October 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Why this matters for your vendors

WS_FTP Server is often where your data lands when a supplier, payroll provider, logistics partner or customer exchanges files with you. A partner that missed the September and October service packs may be running a server that can leak its administrator credentials.

Forward this to your TPRM owner: Four short questions for file-exchange vendors and partners (Rescana guidance):

• Do you run Progress WS_FTP Server, including for transfers with us?
• Is every instance on 2024.0.7 or 2025.0.4 or later, with none on retired 2022.x or older, and is there a plan to move 2024.x instances to 2025.0?
• Are the Web Admin and Manager consoles limited to trusted administrative networks?
• Did you rotate WS_FTP administrator and stored credentials after upgrading, and if any instance is not yet fixed, when will it be?

Working through file-transfer partners with questions like these? We can help you track their answers alongside the rest of their security posture. Book a demo.