WS_FTP Server EUVD-2026-113019

Exploitation requires the attacker to already possess a valid user's password for a WS_FTP Server account, and targets the Web Transfer Module of WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows where multi-factor authentication is configured as the protective control. The flaw lets that password-holding attacker reach 'certain files associated with that account' without satisfying the MFA requirement. Limiting factors that reduce real-world risk: the attacker must have obtained valid credentials beforehand (so this alone is not a full unauthenticated compromise), the impact is confined to read access to that single account's associated files, and the supplied vector indicates user interaction (UI:R) is involved although the sources do not describe what that interaction is. The complete fix is upgrading to the fixed versions as stated by the vendor.

This is a genuinely low-to-moderate priority issue, not a high-CVSS scare. The vendor CVSS is 4.3 (Medium) and all decision signals point the same way: there is no CISA KEV listing (not actively exploited), no EPSS score was supplied, and no public exploit or PoC reference is present in the input - only a single vendor advisory. The vuln.today decision label is 'this_month', i.e. a normal-cadence patch priority rather than act_now or emergency. The exploit's own mechanics limit it: the attacker must already possess a legitimate user's password, and the payoff is only an MFA bypass granting read access to 'certain files associated with that account' (C:L, I:N, A:N) - no write, no code execution, no privilege escalation, no availability impact. One signal conflicts and should be verified with the vendor: the supplied CVSS vector sets PR:N (unauthenticated), yet the description explicitly requires 'an attacker with a user's password', which is authentication material - these are inconsistent, and the PR:N rating appears to understate the real precondition. The vector also sets UI:R, but the description does not explain what user interaction is involved; the trigger is not described in the available sources. Net: a credential-dependent MFA-bypass with limited confidentiality impact - patch on routine cadence, not as an emergency.

An attacker who has already obtained a valid WS_FTP Server user's password (for example via phishing or credential reuse) logs into the Web Transfer Module and reaches certain files tied to that account without ever completing the multi-factor authentication challenge that was supposed to protect the login. No public exploit code or PoC reference is present in the input, and the specific request or interaction that defeats the MFA step is not described in the available sources. The exposure is limited to reading files associated with the compromised account.