{"id":"CVE-2026-84296","kind":"vulnerability","aliases":["CVE-2026-84296"],"related":[],"title":"WS_FTP Server: SSH flaw lets logged-in users skip multi-factor login","description":"Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.","summary":"In Progress WS_FTP Server, the SSH component wrongly links authentication factors between accounts, letting an already authenticated user bypass multi-factor authentication. The attacker gets access that should require a second factor.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","ssh","windows","ws_ftp-server"],"not_affected_if":["fixed-version","ssh-disabled"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed ranges below.\n- Confirm whether SSH access is enabled for WS_FTP Server on Windows.","fix":"- WS_FTP Server prior to `2024.0.6` should move to `2024.0.6` or later.\n- WS_FTP Server `2025.0.x` before `2025.0.3` should move to `2025.0.3` or later.","status":"open","published_at":"2026-10-29T16:19:29+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:30:13+00:00","updated_at":"2026-10-29T16:30:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.6` should move to `2024.0.6` or later.\n- WS_FTP Server `2025.0.x` before `2025.0.3` should move to `2025.0.3` or later.","reach":"network","title":"WS_FTP Server: SSH flaw lets logged-in users skip multi-factor login","impact":"medium","summary":"In Progress WS_FTP Server, the SSH component wrongly links authentication factors between accounts, letting an already authenticated user bypass multi-factor authentication. The attacker gets access that should require a second factor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ws_ftp-server","windows","ssh","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user bypasses MFA on accounts they do not own","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version against the fixed ranges below.\n- Confirm whether SSH access is enabled for WS_FTP Server on Windows.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","ssh-disabled"],"who_is_affected":"Systems running WS_FTP Server on Windows with the SSH component in use. The flaw needs an account that can already log in, so exposure depends on who holds valid credentials. Installations on fixed versions or without SSH enabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4129,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-84296':18A,21A '2024.0.6':84C '2025.0.3':86C 'access':59B 'account':45B,103C 'allow':89C 'alreadi':48B 'associ':98C 'attack':57B 'authent':42B,49B,55B,69C,90C,100C 'bypass':51B,70C,93C 'compon':39B,74C 'cve':16A,19A 'factor':14A,43B,54B,65B,68C,101C 'flaw':5A 'ftp':2A,30B,35B,79C 'ftp-server':29B 'get':58B 'host':25B 'improp':97C 'let':6A,46B 'link':41B 'log':8A 'logged-in':7A 'login':15A 'mfa':94C 'multi':13A,53B,67C 'multi-factor':12A,52B,66C 'packag':22B 'prior':82C 'progress':33B,76C 'requir':62B,95C 'second':64B 'self':24B 'self-host':23B 'server':3A,31B,36B,80C 'skip':11A 'softwar':77C 'ssh':4A,26B,38B,73C 'user':10A,50B,91C 'version':81C 'vulner':71C 'window':27B,88C 'wrong':40B 'ws':1A,28B,34B,78C","nicknames":[],"mitigations":[],"who_affected":"Systems running WS_FTP Server on Windows with the SSH component in use. The flaw needs an account that can already log in, so exposure depends on who holds valid credentials. Installations on fixed versions or without SSH enabled can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84296","severity":null,"published_at":"2026-10-29T16:19:29+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}