WS_FTP Server CVE-2026-84296

Exploitation requires the attacker to already be an authenticated user with valid WS_FTP Server SSH credentials (PR:L) and requires MFA to be configured/enforced on the SSH component, which is the control being bypassed. The specific trigger is an improper association of authentication factors between accounts, meaning the attacker must bring about or exploit this cross-account factor-association condition - consistent with the high attack complexity (AC:H), exploitation is not a simple repeatable action. Limiting factors: valid credentials are mandatory (not unauthenticated), the deployment must run an affected WS_FTP Server version (prior to 2024.0.6 or 2025.0.3) on Windows with MFA in use, and the exact mechanism of the factor association is not detailed in the available sources.

This is a moderate-severity, authenticated MFA bypass (CVSS 6.8, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N; CWE-303). The signals are internally consistent and point to a real-but-not-urgent issue rather than a mass-exploitation threat. The attack vector is network (AV:N) but gated by two meaningful brakes: the attacker must already hold valid credentials (PR:L, so authenticated), and attack complexity is high (AC:H), reflecting that exploitation depends on an abnormal 'improper association of authentication factors between accounts' rather than a trivially repeatable request. Impact is high to confidentiality and integrity but none to availability (C:H/I:H/A:N), consistent with defeating an access control rather than causing disruption. No EPSS score was supplied, so exploitation probability cannot be quantified. There is no CISA KEV listing in the input and no public PoC or exploit reference (the only reference is a Progress vendor knowledge-base advisory), so exploitation status is 'no public exploit identified at time of analysis.' The vendor/industry decision label is 'this_month,' which aligns with the picture: a credentialed authentication-control weakness worth remediating on a normal patch cycle, not an emergency. The main residual uncertainty is mechanism - the description states the flaw is an improper cross-account association of authentication factors but does not detail the exact trigger.

An attacker who already holds valid WS_FTP Server SSH credentials for one account leverages the improper association of authentication factors between accounts to satisfy or sidestep the MFA requirement, gaining authenticated access without completing the intended second factor. The high attack complexity (AC:H) means this depends on a specific cross-account factor-association condition rather than a simple repeatable request. No public exploit or PoC is identified in the available data.