Progress Software WS_FTP Server
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-90872 | < 2024.0.7 ; < 2025.0.4 | Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server | MEDIUM 6.6 | |||
| CVE-2026-90871 | < 2024.0.7 ; < 2025.0.4 | Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server | MEDIUM 5.3 | |||
| CVE-2026-90870 | < 2024.0.7 ; < 2025.0.4 | Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server | MEDIUM 5.3 | |||
| CVE-2026-90869 | < 2024.0.7 ; < 2025.0.4 | Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server | HIGH 7.5 | |||
| CVE-2026-90868 | < 2024.0.7 ; < 2025.0.4 | OS Command Injection in Progress WS_FTP Server | CRITICAL 9.9 | |||
| CVE-2026-90867 | < 2024.0.7 ; < 2025.0.4 | Improper Access Control of Web Admin Console in Progress WS_FTP Server | HIGH 8.1 | |||
| CVE-2026-90866 | < 2024.0.7 ; < 2025.0.4 | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | CRITICAL 9.1 | |||
| CVE-2026-90865 | < 2024.0.7 ; < 2025.0.4 | Command Injection via FTP Notification Variables in Progress WS_FTP Server | CRITICAL 9.0 | |||
| CVE-2026-90864 | < 2024.0.7 ; < 2025.0.4 | Host Administrator Path Containment Bypass in Progress WS_FTP Server | CRITICAL 9.1 | |||
| CVE-2026-90863 | < 2024.0.7 ; < 2025.0.4 | Privilege Escalation via Missing Authorization in WS_FTP Manager | CRITICAL 9.1 | |||
| CVE-2026-90862 | < 2024.0.7 ; < 2025.0.4 | Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server | MEDIUM 4.3 | |||
| CVE-2026-90861 | < 2024.0.7 ; < 2025.0.4 | Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server | MEDIUM 6.6 | |||
| CVE-2026-84296 | < 2024.0.6 ; < 2025.0.3 | SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server | MEDIUM 6.8 | |||
| CVE-2026-84295 | < 2024.0.6 ; < 2025.0.3 | Improper Authentication in Progress WS_FTP Server | CRITICAL 10.0 | |||
| CVE-2026-84294 | < 2024.0.6 ; < 2025.0.3 | Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server | HIGH 7.7 |