{"id":"CVE-2026-84295","kind":"vulnerability","aliases":["CVE-2026-84295"],"related":[],"title":"WS_FTP Server: improper authentication exposes admin credentials to unauthenticated attackers","description":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.","summary":"WS_FTP Server on Windows, before versions 2024.0.6 and 2025.0.3, has an authentication flaw. An unauthenticated remote attacker can read sensitive information, including administrative credentials.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","infrastructure","self-hosted","windows","ws_ftp"],"not_affected_if":["not-windows","patched-version"],"how_to_check":"- Check the installed WS_FTP Server version in the product's About or version info, and compare it with `2024.0.6` and `2025.0.3`\n- Confirm the server runs on Windows, since the sources name Windows specifically","fix":"- Upgrade WS_FTP Server to `2024.0.6` or later on the 2024 line\n- Upgrade WS_FTP Server to `2025.0.3` or later on the 2025 line","status":"open","published_at":"2026-10-29T16:19:29+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:27:07+00:00","updated_at":"2026-10-29T16:27:07+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-29T16:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WS_FTP Server to `2024.0.6` or later on the 2024 line\n- Upgrade WS_FTP Server to `2025.0.3` or later on the 2025 line","reach":"network","title":"WS_FTP Server: improper authentication exposes admin credentials to unauthenticated attackers","impact":"high","summary":"WS_FTP Server on Windows, before versions 2024.0.6 and 2025.0.3, has an authentication flaw. An unauthenticated remote attacker can read sensitive information, including administrative credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ws_ftp","windows","file-transfer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads administrative credentials without logging in","analyst_note":"Confirm the affected version ranges and whether the exposed network reach is internet or internal, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-84295 and the vendor advisory.","how_to_check":"- Check the installed WS_FTP Server version in the product's About or version info, and compare it with `2024.0.6` and `2025.0.3`\n- Confirm the server runs on Windows, since the sources name Windows specifically","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","not-windows"],"who_is_affected":"Any Windows host running WS_FTP Server older than 2024.0.6 or 2025.0.3 is exposed, and the flaw needs no login. Teams that run WS_FTP Server on a network reachable by outsiders should treat it as urgent. Teams on a patched version or with no WS_FTP Server installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000738,"input_tokens":4113,"output_tokens":654,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84295':14A,17A '2024.0.6':35B,64C '2025.0.3':37B,66C 'access':76C 'admin':7A 'administr':51B,80C 'allow':70C 'attack':11A,45B,74C 'authent':5A,40B,54C 'could':69C 'credenti':8A,52B,81C 'cve':12A,15A 'expos':6A 'file':19B 'file-transf':18B 'flaw':41B 'ftp':2A,27B,29B,59C 'host':24B 'improp':4A,53C 'includ':50B,79C 'inform':49B,78C 'infrastructur':21B 'prior':62C 'progress':56C 'read':47B 'remot':44B,73C 'self':23B 'self-host':22B 'sensit':48B,77C 'server':3A,30B,60C 'softwar':57C 'transfer':20B 'unauthent':10A,43B,72C 'version':34B,61C 'window':25B,32B,68C 'ws':1A,26B,28B,58C","nicknames":[],"mitigations":[],"who_affected":"Any Windows host running WS_FTP Server older than 2024.0.6 or 2025.0.3 is exposed, and the flaw needs no login. Teams that run WS_FTP Server on a network reachable by outsiders should treat it as urgent. Teams on a patched version or with no WS_FTP Server installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84295","severity":null,"published_at":"2026-10-29T16:19:29+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}