Image: Wikimedia Commons / NERSC (ILLUSTRATIVE — server racks; WS_FTP Server is a Windows file-transfer product, and the flaws concern its software, not hardware).
TL;DR: Progress WS_FTP Server CVE-2026-84295 critical flaw explained: Progress Software patched 15 WS_FTP Server flaws, led by a maximum-severity 10.0 improper-authentication bug that lets an attacker with no login read administrative credentials. The fixes shipped in September and October — but the flaw descriptions only became public on 29 October — so any server still on an older build is now exposed to attacks built from the published details. Patch to 2025.0.4 or 2024.0.7 now.
📌 KEY HIGHLIGHTS
- Worst flaw scores 10.0: CVE-2026-84295 lets an unauthenticated remote attacker access sensitive information, including administrative credentials, on Windows WS_FTP Server installations.
- 15 flaws in one batch: 6 critical, 3 high and 6 medium, covering authentication, authorisation, command injection and path traversal across the web and transfer components.
- Fixes already shipped: 2025.0.3 (3 September) and 2025.0.4 (1 October) on the 2025 line; 2024.0.6 and 2024.0.7 on the 2024 line — a server patched in October is already safe.
- The catch: CVE records went public on 29 October and were reported on 2 November, so unpatched servers now face published flaw descriptions.
- No exploitation yet: Progress reports no active exploitation, no public proof-of-concept exists, and none of the flaws was on CISA's Known Exploited Vulnerabilities list as of 2 November.
What happened?
Progress Software's WS_FTP Server is a managed file-transfer product used by businesses to move files between systems and partners — the same product category that has suffered the worst mass-exploitation incidents of recent years. On 29 October 2026, Progress published CVE records for 15 vulnerabilities in the Windows product. Security outlets including heise and SecurityOnline reported the batch on 2 November, and that reporting is what turned a quiet patch cycle into an urgent one: the fixes had been available for weeks, but the detailed flaw descriptions are now public, which is exactly the window attackers use to build exploits against servers that never upgraded.
The headline flaw, CVE-2026-84295, is rated 10.0 on the CVSS scale — the maximum possible. Progress describes it as improper authentication in WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows: an unauthenticated remote attacker can access sensitive information, including administrative credentials. In plain terms, someone who does not even have an account on the server can reach in and read the keys to the kingdom. Two more flaws in the same batch let attackers run operating-system commands on the server: CVE-2026-90868 (9.9) and CVE-2026-90865 (9.0, through FTP notification variables, with elevated privileges).
Progress WS_FTP Server CVE-2026-84295 critical flaw explained: the full batch
The remaining critical flaws are subtler but dangerous on shared servers. WS_FTP lets a company hand a partner or customer a limited "Host Administrator" login for one site. Three flaws let that limited administrator break out of their box: CVE-2026-90863 (9.1, missing authorisation in the WS_FTP Manager interface, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the server) and CVE-2026-90866 and CVE-2026-90864 (9.1 each, path traversal reaching files outside the folders the administrator is meant to manage). Below the critical tier sit a Web Admin console access-control flaw (CVE-2026-90867, 8.1), a path-traversal flaw (CVE-2026-84294, 7.7) and an SSH multi-factor authentication bypass (CVE-2026-84296, 6.8), with the rest of the 15 rated from 4.3 upward.
| Flaw | Score | What it allows | Fixed in |
|---|---|---|---|
| CVE-2026-84295 | 10.0 | Unauthenticated remote attacker reads admin credentials | 2025.0.3 / 2024.0.6 |
| CVE-2026-90868 | 9.9 | OS command injection, arbitrary command execution | 2025.0.4 / 2024.0.7 |
| CVE-2026-90863 | 9.1 | Delegated Host Admin exceeds scope, possible full compromise | 2025.0.4 / 2024.0.7 |
| CVE-2026-90866, CVE-2026-90864 | 9.1 each | Path traversal outside managed folders | 2025.0.4 / 2024.0.7 |
| CVE-2026-90865 | 9.0 | Command injection via FTP notification variables, elevated privileges | 2025.0.4 / 2024.0.7 |
| CVE-2026-84296 | 6.8 | SSH multi-factor authentication bypass | 2025.0.3 / 2024.0.6 |
Image: Wikimedia Commons / Markus Spiske, CC0 (ILLUSTRATIVE — code on a monitor; the flaws are in WS_FTP Server's authentication and input handling).
Why it matters for World Tech readers
File-transfer servers are prized targets precisely because they sit at the edge of a network holding other people's data — the MOVEit mass-exploitation campaign showed what happens when a flaw like this is weaponised at scale. The reassuring part here is timing: nobody needs to wait for a fix, because the fixes have existed since September and October. The worrying part is the same timing in reverse — every unpatched server is now a known target with a published description of how to break in, and the worst flaw needs no login at all. Any internet-facing WS_FTP server still on a pre-October build should be treated as potentially exposed: upgrade, then review administrator accounts, since CVE-2026-84295 exposes their credentials.
This is the third major patch-now story in a week on TechByCountry, after our Ivanti Connect Secure zero-day chain explainer and our Northflank breach explainer — and unlike those, this one comes with no confirmed exploitation yet, which makes it the cheapest incident to prevent. Patching today costs an upgrade window; patching after exploitation costs an incident response.
Should you care?
✅ Verdict: Yes, if you run WS_FTP Server on Windows — check the version in WS_FTP Manager today: 2025.0.4 or later on the 2025 line, 2024.0.7 or later on the 2024 line. Anything older needs the upgrade before the published flaw details turn into working exploits. If you do not run WS_FTP, this is still a useful warning sign: when a vendor quietly patches and the details go public weeks later, the patch deadline is the publication date, not the next maintenance window.
FAQs
What is CVE-2026-84295? CVE-2026-84295 is an improper-authentication flaw in Progress WS_FTP Server on Windows, rated 10.0 — the maximum CVSS score. It lets an unauthenticated remote attacker access sensitive information, including administrative credentials, on versions prior to 2024.0.6 and 2025.0.3.
Which WS_FTP Server versions are affected? The three flaws fixed in 2025.0.3 and 2024.0.6 — including CVE-2026-84295 and the SSH MFA bypass — affect earlier versions on both lines. The other twelve flaws affect versions prior to 2025.0.4 and 2024.0.7. Only Windows installations are affected, according to Progress's CVE records.
How do I check if my WS_FTP Server is safe? Open WS_FTP Manager and read the version number: 2025.0.4 or later on the 2025 line, or 2024.0.7 or later on the 2024 line, means all 15 flaws are fixed. Anything older needs the upgrade, and an internet-facing server that was reachable before October deserves a review of its administrator accounts.
Is CVE-2026-84295 being exploited? No — Progress's records report no exploitation, researchers have published no proof-of-concept exploit code, and none of the 15 flaws was on CISA's Known Exploited Vulnerabilities catalogue when checked on 2 November. That clean status is exactly why patching now, before exploits appear, matters.
Takeaway: A 10.0 flaw with no login required and fixes already available is the easiest kind of disaster to avoid — upgrade to 2025.0.4 or 2024.0.7 before the published details become working exploits.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- TrustList — Progress discloses critical WS_FTP Server flaws fixed weeks ago (2 November 2026)
- SecurityOnline — CVE-2026-84295: 10.0 CVSS WS_FTP Server Vulnerabilities (2 November 2026)
- CVEFeed — CVE-2026-84295: Improper Authentication in Progress WS_FTP Server
- Rapid7 — CVE-2026-84296: WS_FTP Server SSH Multi-Factor Authentication Bypass
Comments
Post a Comment