{"id":"CVE-2023-40044","kind":"vulnerability","aliases":["CVE-2023-40044"],"related":[],"title":"progress ws ftp server: In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET…","description":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Progress WS_FTP Server has a deserialization flaw in its Ad Hoc Transfer module that lets an authenticated user run remote commands on the underlying operating system. CISA lists it as actively exploited, and the tags note ransomware use.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2023-10-05T00:00:00+00:00","products":[{"name":"Progress WS_FTP Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"progress ws ftp server","fixed":["8.7.4"],"affected":"< 8.7.4","ecosystem":"vendor"},{"name":"progress ws ftp server","fixed":["8.8.2"],"affected":">= 8.8, < 8.8.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-transfer","other","ransomware","windows","ws_ftp_server"],"not_affected_if":["no-ws-ftp-server-deployed"],"how_to_check":null,"fix":"Apply the vendor mitigations per the Progress advisory; if none are available, discontinue use of the product (per CISA required action).","status":"open","published_at":"2023-09-27T15:18:57+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:29+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T21:04:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per the Progress advisory; if none are available, discontinue use of the product (per CISA required action).","reach":"internet","impact":"high","summary":"Progress WS_FTP Server has a deserialization flaw in its Ad Hoc Transfer module that lets an authenticated user run remote commands on the underlying operating system. CISA lists it as actively exploited, and the tags note ransomware use.","category":"other","who_cares":["ws_ftp_server","file-transfer","windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary commands on the server OS","analyst_note":"Find the vendor advisory and the patched or mitigated versions for WS_FTP Server Ad Hoc Transfer; the sources gave no affected or fixed versions and no check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ws-ftp-server-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000474,"input_tokens":2848,"output_tokens":378,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':25A,28A '-40044':26A,29A '8.7.4':12A '8.8.2':14A 'action':124C 'activ':83B 'ad':62B,104C 'allow':109C 'appli':125C 'attack':19A,112C 'authent':18A,69B,111C 'cisa':79B,122C 'command':73B,116C 'contain':95C 'could':20A 'cve':24A,27A 'data':100C 'deseri':58B,97C 'discontinu':131C 'execut':114C 'exploit':42B,84B 'file':44B 'file-transf':43B 'flaw':59B 'ftp':3A,7A,32A,36A,40A,50B,54B,93C 'hoc':63B,105C 'instruct':129C 'let':67B 'leverag':21A 'list':80B 'mitig':126C,137C 'modul':65B,107C 'net':23A 'note':88B 'oper':77B,120C 'per':127C 'pre':17A 'pre-authent':16A 'prior':10A 'product':135C 'progress':1A,30A,34A,38A,52B,91C 'ransomwar':47B,89B 'remot':72B,115C 'requir':123C 'run':71B 'server':4A,8A,33A,37A,41A,51B,55B,94C 'system':78B,121C 'tag':87B 'transfer':45B,64B,106C 'unavail':139C 'under':76B,119C 'untrust':99C 'use':90B,132C 'user':70B 'vendor':128C 'version':9A 'vulner':101C 'window':48B 'ws':2A,6A,31A,35A,39A,49B,53B,92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-27T15:18:57+00:00","kev":{"dateAdded":"2023-10-05","dueDate":"2023-10-26","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-40044","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-40044","severity":null,"published_at":"2023-10-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-40044","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40044","severity":null,"published_at":"2023-09-27T15:18:57+00:00","modified_at":"2026-06-17T06:15:55+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}