Live › vulnerability › CVE-2026-84295
WS_FTP Server on Windows, before versions 2024.0.6 and 2025.0.3, has an authentication flaw. An unauthenticated remote attacker can read sensitive information, including administrative credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Any Windows host running WS_FTP Server older than 2024.0.6 or 2025.0.3 is exposed, and the flaw needs no login. Teams that run WS_FTP Server on a network reachable by outsiders should treat it as urgent. Teams on a patched version or with no WS_FTP Server installed can skip it.
No product ranges from the sources yet.
2024.0.6 and 2025.0.32024.0.6 or later on the 2024 line2025.0.3 or later on the 2025 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-84295")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.