Zero Radar
← feed
CriticalVulnerabilityCVE-2026-84295updated 29 Oct 2026, 16:20 UTC

WS_FTP Server flaw lets outsiders reach admin credentials

A file transfer server can be tricked into giving sensitive data, including admin passwords, to someone who never logged in. An attacker could then take control of the server.

Fix availableOfficial source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 2024.0.6 and 2025.0.3 (fixed versions per NVD) · since 29 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or account needed
  2. 2Reaches exposed serverWS_FTP Server reachable over network
  3. 3Authentication bypassedImproper authentication check on Windows
  4. 4Admin credentials exposedSensitive data including credentials leaks
  5. ResultAttacker gains administrative access

What happened

Improper authentication in Progress Software WS_FTP Server on Windows allows an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Why it is dangerous: Stolen administrative credentials could let an attacker manage the file transfer server and read or change the files it holds. Organizations running WS_FTP Server on Windows are at risk.

Are you affected?

You are affected if you run WS_FTP Server on Windows in a version prior to 2024.0.6 or 2025.0.3.

Progress Software WS_FTP Server on Windows, versions prior to 2024.0.6 and prior to 2025.0.3

What to do

  1. Update WS_FTP Server to 2024.0.6 or 2025.0.3 or later
  2. Change any administrative passwords stored or used on the server after patching
  3. Review server logs for unexpected access to administrative or credential data

Timeline

  1. 29 Oct 2026, 16:19 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:19 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 16:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-84295
CVSS
10 / 10
Disclosed
29 Oct 2026, 16:19 UTC
On Zero Radar
29 Oct 2026, 16:20 UTC (1 min after disclosure)
Last change
29 Oct 2026, 16:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WS_FTP Server flaw lets outsiders reach admin credentials · Zero Radar