External risk intelligence

Progress WS_FTP Server Improper Authentication Information Disclosure

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-84295

Progress Software WS_FTP Server is an internet-facing file transfer service designed for remote access and data exchange. As a server-based gateway application, it is commonly deployed with public-facing network exposure to facilitate file transfers, making it a service that is public-facing by design in normal operational use.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE addresses an improper authentication vulnerability in Progress Software WS_FTP Server. An unauthenticated remote attacker could potentially gain access to sensitive information, including administrative credentials. The main concern is confirming the relevance and exposure of this technology within our environment.

Unauthenticated access to sensitive information.
Confirms potential for unauthorized administrative access.
Verify if WS_FTP Server is in use.

Attack Path

How an attacker could exploit the issue

An attacker could begin by reaching the Progress Software WS_FTP Server over the network. If the server is configured with weak authentication or has certain improper authentication flaws, an attacker might bypass authentication controls. This could allow them to access sensitive information, such as administrative credentials, potentially enabling further malicious actions.

Network access required.
Bypass authentication checks.
Access sensitive information.

Live Threat

Current exploitation, exposure, and threat context

Improper authentication in Progress Software WS_FTP Server could permit an unauthenticated remote attacker to access sensitive information, including administrative credentials, when supported by the advisory's conditions.

Administrative credentials.
Unauthenticated remote access.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and system owners should prioritize identifying all instances of Progress Software WS_FTP Server within their environment, confirming their exposure and business criticality, and then engaging the appropriate application or infrastructure teams to plan remediation. The first practical step involves locating the affected technology, assessing its reachability and impact, and identifying the accountable owner to determine the best course of action.

Confirm application and infrastructure ownership.
Verify external reachability and business impact.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress Software WS_FTP Server?

Progress Software WS_FTP Server is an enterprise-grade file transfer solution designed for Windows environments. It enables organizations to securely exchange, manage, and move files across networks. Because it functions as a gateway for data transfers, it is frequently configured to provide remote access capabilities to partners or employees who need to upload or download files from various locations.

What does CVE-2026-84295 mean by improper authentication?

This CVE highlights a security weakness categorized as CWE-287 and CWE-522. In plain terms, the server fails to correctly verify the identity of someone trying to connect. Because the authentication process is flawed, the system essentially 'trusts' an incoming request without proper validation, allowing a remote user to bypass security checks and gain unauthorized access to data, including administrative credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by initiating a network connection to the affected WS_FTP Server. The vulnerability allows them to interact with the service as if they were a legitimate user without providing valid credentials. It is important to note that this is not triggered by specific file types or user actions; the flaw exists within the authentication mechanism itself, which fails to gate access regardless of the user's intent.

Is my environment at risk with this vulnerability?

Halo Surface Signal indicates that WS_FTP Server is often deployed as an internet-facing gateway to facilitate external file transfers. If your instance is reachable from the public internet, it falls into a high-risk category because attackers do not need prior access to your internal network to attempt to exploit this flaw. Systems that are restricted to internal-only use have a smaller attack surface, but they remain vulnerable to local network actors.

Do I need to update my software to fix this issue?

The first practical step is to verify if you are running a version of WS_FTP Server prior to 2024.0.6 or 2025.0.3. Your immediate priority should be to locate all instances in your environment and confirm who manages them. Once you have an inventory, coordinate with your infrastructure or application teams to review the manufacturer's provided updates and determine the timeline for applying the necessary security patches.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.