EUVD-2026-120109

Insufficient protection of communications in Progress WSFTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used...

CVE-2026-115338

Progress WS_FTP Server versions prior to 2025.0.5 are susceptible to insufficient protection of communications. A network attacker can intercept sensitive information or modify requests when unencrypted connections are used. Remediation is available via the WS_FTP Server Service Pack November 202...

CVE-2026-115337

Progress WS_FTP Server versions prior to 2025.0.5 are vulnerable to an improper access control flaw. This vulnerability allows an authenticated user with specific folder-management permissions to bypass access restrictions , potentially enabling them to access or modify files belonging to other u...

CVE-2026-115337

Improper access control in Progress WSFTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users...

CVE-2026-115338

Insufficient protection of communications in Progress WSFTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used...

CVE-2026-90871

Improper limitation of a pathname to a restricted directory in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory...

CVE-2026-90872 Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WSFTP...

CVE-2026-90872

Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4 ) is vulnerable to an improper neutralization of directives in dynamically evaluated code within the Manager web console . This flaw allows an authenticated Manager administrator to execute arbitrary commands with...

CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation...

CVE-2026-90870

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are vulnerable to server resource exhaustion. The root cause is a missing release of backend receiver sessions within the Ad Hoc Transfer component. Successful exploitation could lead to service degradation . No sp...

CVE-2026-90869

Progress Software WS_FTP Server on Windows (versions prior to 2024.0.7 and 2025.0.4 ) is vulnerable to a Denial of Service (DoS) attack. A remote attacker who possesses a valid account's enrolled SSH public key can exploit an out-of-bounds read and improper input validation (CWE-125, CWE-20) to t...

CVE-2026-90869 Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows...

CVE-2026-90869 Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows...

CVE-2026-90868 OS Command Injection in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations...

CVE-2026-90868

Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4 is vulnerable to an OS command injection vulnerability. This flaw allows for arbitrary command execution under certain configurations. The vulnerability is associated with CWE-78 (Improper Neutralization of Special...

CVE-2026-90868 OS Command Injection in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations...

CVE-2026-90867

Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4 is susceptible to an Improper Access Control vulnerability (CWE-284) within the Web Admin console . This flaw could allow remote actors to access administrative functionality via remote authentication attempts . Th...

CVE-2026-90867 Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

CVE-2026-90867 Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...