CVE Index中文
L3 · ShartedWS_FTP · RCE · authenticationwsftp-october-batch

Progress discloses 15 WS_FTP Server flaws, including unauthenticated credential exposure

Progress publishes 15 Windows WS_FTP Server CVEs, including CVSS 10.0 credential exposure and configuration-dependent command execution. Install 2024.0.7 or 2025.0.4 to cover the batch; the command-execution paths have different privilege prerequisites.

Disclosed
Oct 29, 2026
Public disclosure date
Severity
CVSS 10 × 1
15 CVEs tracked here
Splash zone
Windows WS_FTP Server below 2024.0.7 or 2025.0.4; exposure varies by component, configuration and account privileges
windows
In the wild
Unknown
The cited vendor records do not confirm exploitation or publish victim counts.

What happened

The public CVE disclosure is October 29; the fixing service packs were available earlier. This is one advisory batch with 15 CVEs, not 15 separate incidents. L3 reflects a widely deployed file-transfer server and critical disclosed issues; the sources do not establish exploitation.

CVE-2026-84295 exposes sensitive information, potentially administrative credentials, without authentication. Do not describe every critical item as unauthenticated RCE: CVE-2026-90868 needs low privileges; 90863, 90864 and 90866 need delegated Host Administrator access; 90865 is configuration-dependent with a high-complexity vector. The public records do not identify every setting needed for command injection, so an assumed default configuration is not a reliable exemption.

The vendor’s linked Salesforce advisory was not retrievable; its own CNA records provide the primary descriptions and patch boundaries, corroborated by first-party release histories. No public attacker indicators or victim totals are supplied.

What’s in the bowl

CVE-2026-84294CVSS 7.7

Ad Hoc Transfer file read

Authenticated users can read files beyond the intended directory.

CVE-2026-84295CVSS 10

Unauthenticated administrative credential exposure

A remote attacker without a login can obtain sensitive data, potentially including administrative credentials.

CVE-2026-84296CVSS 6.8

SSH MFA bypass

Authenticated users can bypass MFA through incorrect association of authentication factors between accounts.

CVE-2026-90861CVSS 6.6

Password exposure in activity logs

An administrator can obtain another user’s clear-text password and potentially broader administrative access.

CVE-2026-90862CVSS 4.3

Web Transfer MFA bypass

An attacker who knows a user’s password can access certain account files without completing MFA.

CVE-2026-90863CVSS 9.1

Missing Manager authorization

A delegated Host Administrator can exceed assigned scope, potentially executing elevated commands on the host.

CVE-2026-90864CVSS 9.1

Host Administrator path bypass

A delegated Host Administrator can read or modify files outside the authorized path.

CVE-2026-90865CVSS 9

FTP notification command injection

Certain configurations permit elevated command execution through notification variables; the vendor vector needs no login but has high attack complexity.

CVE-2026-90866CVSS 9.1

Virtual-folder confinement bypass

A delegated Host Administrator can escape virtual-folder scope, potentially reaching code execution.

CVE-2026-90867CVSS 8.1

Web Admin access control

Remote authentication attempts can reach administrative functionality because of improper access control; this alone does not establish successful authentication.

CVE-2026-90868CVSS 9.9

Configuration-dependent command injection

The vendor rates this code-execution path as requiring low privileges under certain configurations; it is not an unauthenticated RCE claim.

CVE-2026-90869CVSS 7.5

Pre-authentication SSH denial of service

A remote attacker knowing a valid account’s enrolled SSH public key can terminate the shared SSH service.

CVE-2026-90870CVSS 5.3

Ad Hoc Transfer resource exhaustion

Unreleased receiver sessions can exhaust resources and degrade service without authentication.

CVE-2026-90871CVSS 5.3

Transfer file deletion via traversal

An unauthenticated attacker can affect files outside transfer directories; the vendor title identifies file deletion.

CVE-2026-90872CVSS 6.6

Manager server-side script injection

An authenticated Manager administrator can execute commands as the WS_FTP Server IIS worker process.

Fixed versions

ProductSafe fromNote
WS_FTP Server 20242024.0.79.0.7; covers the batch, but the line is now in Sunset
WS_FTP Server 20252025.0.410.0.4; active line

Crime-scene timeline

  1. Sep 3, 2026

    2024.0.6 and 2025.0.3 release

    These fix the 84294–84296 subgroup, not the full later batch.

  2. Oct 1, 2026

    2024.0.7 and 2025.0.4 release

  3. Oct 29, 2026

    Progress publishes 15 CVE records describing the flaws

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Other turds from around the same time

L4 · Oct 29, 2026Polymarket confirms third-party breach; researchers find wallet-draining DebugBear scriptL3 · Oct 29, 2026Binance pauses withdrawals for security checks after reported wallet outflowsL3 · Oct 29, 2026Nomad patches three isolation flaws, including workload-to-host symlink attacks