CVE-2026-84295 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as Improper Authentication in Progress Software WS_FTP Server represents a critical security flaw affecting versions prior to 2024.0.6 and 2025.0.3 on Windows operating systems. This defect allows an unauthenticated remote attacker to bypass access controls that are intended to restrict entry to sensitive system resources. The core technical issue lies in the application's failure to properly validate credentials or session tokens before granting access to administrative interfaces or configuration files. In many such implementations, this often stems from a misconfiguration of authentication middleware or a logic error where specific endpoints fail to enforce mandatory security checks for all users regardless of their privilege level. This results in a state where the server treats unauthenticated requests as valid, effectively opening a backdoor into the administrative layer of the FTP service.
From an operational perspective, the impact of this vulnerability is severe due to the nature of WS_FTP Server as a file transfer application often used for business-critical data exchange. An attacker who exploits this flaw can gain unauthorized access to sensitive information, most notably administrative credentials stored within configuration files or database backends associated with the server. The compromise of these credentials allows the attacker to escalate their privileges from an unauthenticated state to full system control. With administrative rights, the threat actor can modify FTP settings, create new user accounts, alter file permissions, and potentially execute arbitrary commands on the host machine if further exploitation vectors are available. This level of access facilitates data exfiltration, where confidential business documents or personally identifiable information is stolen, as well as potential ransomware deployment or use of the server as a pivot point for lateral movement within the corporate network.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically falling under scenarios where an actor is able to bypass authentication mechanisms due to insufficient validation logic. Furthermore, in the context of the MITRE ATT&CK framework, this flaw enables techniques associated with Initial Access and Credential Access. The attacker leverages the lack of proper access control to gain foothold (T1078) and subsequently harvests credentials from local system or application data stores (T1552). The ability to read administrative configurations without authentication is particularly dangerous as it provides the necessary intelligence for subsequent attacks, such as privilege escalation or persistence mechanisms that rely on modifying service accounts or scheduled tasks.
Mitigation strategies must prioritize immediate patching and configuration hardening. Organizations running affected versions of WS_FTP Server should upgrade immediately to version 2024.0.6 or later, where the authentication logic has been corrected to enforce strict validation for all administrative endpoints. In environments where upgrading is not immediately feasible, network-level controls such as firewall rules restricting access to FTP management interfaces to trusted IP addresses only can serve as a temporary compensating control. Additionally, administrators should audit existing configurations to ensure that no other services are exposed without proper authentication and review logs for any signs of unauthorized access attempts or unusual data transfers indicative of exploitation. Regular vulnerability scanning and adherence to least-privilege principles will further reduce the attack surface associated with file transfer servers.