WS_FTP Server EUVD-2026-113027

Exploitation requires that the Ad Hoc Transfer component of WS_FTP Server (versions prior to 2024.0.7 and 2025.0.4, on Windows) be deployed and network-reachable by the attacker, since the unreleased backend receiver sessions originate specifically in that module. Per the CVSS vector (PR:N/UI:N/AC:L) exploitation is remote and does not require authentication or user interaction against a default-reachable Ad Hoc Transfer service. Limiting factors: environments not running or not exposing the Ad Hoc Transfer component are not affected, and the impact is confined to availability degradation (A:L) - no code execution or data exposure. The precise request/session sequence needed to leak sessions is not described in the available sources.

This is a moderate-severity availability-only issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw whose only impact is partial availability loss (A:L) with no confidentiality or integrity effect - consistent with the CWE-400 resource-exhaustion class described (unreleased backend receiver sessions in the Ad Hoc Transfer component). The vuln.today decision label is 'this_month' rather than act_now/emergency, aligning with the modest impact. No EPSS score, KEV listing, or POC/exploit reference was provided in the input, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis; absence of these signals is not evidence of safety but does argue against widespread opportunistic attack today. The signals are internally consistent - a genuine but bounded DoS risk, prioritized for scheduled patching rather than crisis response. No conflicting data was detected, though the lack of EPSS/KEV means exploitation probability is simply unknown rather than confirmed low.

A remote attacker with network access to an internet-facing WS_FTP Server running the Ad Hoc Transfer component repeatedly initiates backend receiver sessions that are never released, gradually exhausting server-side resources. Over time this degrades service and can render the file-transfer service unavailable to legitimate users. No public exploit code is identified at time of analysis, and the precise trigger sequence is not described in the available sources.