Live › vulnerability › CVE-2026-84296
In Progress WS_FTP Server, the SSH component wrongly links authentication factors between accounts, letting an already authenticated user bypass multi-factor authentication. The attacker gets access that should require a second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Systems running WS_FTP Server on Windows with the SSH component in use. The flaw needs an account that can already log in, so exposure depends on who holds valid credentials. Installations on fixed versions or without SSH enabled can skip it.
No product ranges from the sources yet.
2024.0.6 should move to 2024.0.6 or later.2025.0.x before 2025.0.3 should move to 2025.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-84296")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.