Progress Software fixed 15 vulnerabilities in WS_FTP Server on October 29, including CVE-2026-84295, a CVSS 10.0 improper-authentication flaw that lets an unauthenticated remote attacker obtain administrative credentials. No active exploitation or public proof of concept has been confirmed.
CVE-2026-84295 Exposes WS_FTP Administrative Credentials to Attackers
CVE-2026-84295 is an improper authentication flaw. An unauthenticated remote attacker can use it to obtain sensitive information, including administrative credentials, and then reach the server’s management consoles. A CVSS score of 10.0 is the maximum on the scale.
The patched flaws affect WS_FTP Server on Windows in versions before 2024.0.6 or 2024.0.7 and before 2025.0.3 or 2025.0.4, depending on the release branch.
Two Critical OS Command Injection Flaws
Two of the 15 issues are OS command injection flaws. CVE-2026-90868 is rated 9.9 and CVE-2026-90865 is rated 9.0. Command injection lets an attacker run operating system commands on the server, which is why both rank among the critical fixes.
The Rest of the 15-Flaw Patch Set
The remaining vulnerabilities cover several classes. CVE-2026-90863 is a missing-authorization flaw rated 9.1. CVE-2026-90864 and CVE-2026-90866 are path traversal bugs, each also rated 9.1. Two multi-factor authentication bypasses are tracked as CVE-2026-84296 and CVE-2026-90862. Two denial-of-service flaws are CVE-2026-90869 and CVE-2026-90870, and CVE-2026-90861 is a cleartext password leak.
Authentication Bypasses Alongside Credential Exposure
Several of the fixes concern access control directly: the improper authentication in CVE-2026-84295, the missing authorization in CVE-2026-90863 and the two MFA bypasses. Together they cover the steps from reaching the server to holding administrative rights, which is the sequence a takeover would follow if the flaws were combined.
The source does not describe any chained exploit, and it does not say that attackers are combining these bugs.
No Confirmed WS_FTP Exploitation but Many Exposed Servers
Progress has not confirmed active exploitation, and no public proof of concept has been confirmed. The source notes that file transfer gateways have been popular intrusion targets historically and that Shodan shows many exposed servers.
Unpatched servers face a risk of takeover, credential theft and data exfiltration, according to the reporting. Progress’s remedy is to upgrade to the latest service releases.
Why File Transfer Servers Draw Attention
File transfer servers sit at a network boundary and hold files that move between organizations, so a flaw that exposes administrative credentials gives an attacker a route toward stored data. The reporting offers that general historical pattern as context and does not link it to any specific campaign involving these CVEs.
The October 29 release bundles an unusually wide spread of weakness types into one update. A single release addresses authentication, authorization, input handling, multi-factor authentication and availability problems, and five more vulnerabilities score 9.0 or higher beyond the top-rated flaw. For administrators, the practical reading of the advisory is that the fixed service releases replace the vulnerable 2024.0.x and 2025.0.x builds, and that the absence of confirmed exploitation reflects the situation at the time of release rather than a guarantee about what follows.
Version Ranges and Fix Targets for Affected WS_FTP Servers
The affected builds are WS_FTP Server on Windows before 2024.0.6 and 2024.0.7, and before 2025.0.3 and 2025.0.4. The paired numbers correspond to two release lines, 2024.0 and 2025.0, each with its own fixed service release. Progress fixed all 15 vulnerabilities on October 29.
The highest-scoring items cluster tightly. The source lists 11 of the 15 by identifier, and six of those score 9.0 or above: CVE-2026-84295 at 10.0, CVE-2026-90868 at 9.9, CVE-2026-90863, CVE-2026-90864 and CVE-2026-90866 at 9.1 each, and CVE-2026-90865 at 9.0. The MFA bypasses, the two denial-of-service flaws and the cleartext password leak make up the other five.
