Progress WS_FTP Server CVE-2026-84295

Affects Progress WS_FTP Server on Windows at versions prior to 2024.0.6 (2024 branch) and prior to 2025.0.3 (2025 branch); patched releases are not vulnerable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are required - remote, unauthenticated exploitation is possible against reachable instances, and the description names no configuration toggle or non-default feature as a prerequisite. The primary limiting factor is network reachability of the WS_FTP Server endpoint: instances behind segmentation or not exposed to the attacker's network are correspondingly harder to reach. The specific request or trigger is not described in the available sources.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a maximally exposed flaw: network-reachable, low complexity, no privileges, no user interaction, with a scope change - fully consistent with a description that lets an unauthenticated remote attacker read sensitive data including administrative credentials. The vuln.today decision label is 'act_now', reinforcing urgency. Signals do, however, partially conflict on breadth of exploitation: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public proof-of-concept or exploit reference is supplied, so there is no evidence of active exploitation or weaponization at this time. In short, the severity and ease-of-exploitation signals are unambiguous and point to immediate patching, while the real-world exploitation-activity signals (EPSS, KEV, POC) are simply absent rather than negative - their absence should not be read as low risk for a credential-disclosing MFT server, which is historically an attractive target (cf. prior Progress file-transfer incidents).

An attacker who can reach the WS_FTP Server management or service endpoint over the network sends requests that exploit the improper authentication flaw to retrieve sensitive information, including administrative credentials, without supplying valid credentials. With those recovered admin credentials, the attacker logs in as an administrator and takes control of the file-transfer service and its hosted data. No public exploit code is identified at time of analysis, and the exact trigger is not described in the available sources.