CVE-2026-84296 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified vulnerability represents a critical failure in the implementation of Multi-Factor Authentication within the SSH subsystem of Progress Software WS_FTP Server, affecting versions prior to 2024.0.6 and specifically noted for version 2025.0.3 on Windows operating systems. This flaw stems from an improper association mechanism between distinct authentication factors when managing user accounts. In a properly secured environment, Multi-Factor Authentication requires the independent verification of two or more evidences of identity, such as something the user knows (password), something they have (hardware token or mobile device), and something they are (biometric). The vulnerability arises because the application fails to correctly bind these distinct factors to specific user sessions or account contexts during the authentication handshake. This logical error allows an authenticated attacker to exploit the session management logic, effectively decoupling the secondary factor from the primary credential verification process.
From a technical perspective, this flaw is categorized under CWE-287: Improper Authentication and more specifically aligns with CWE-306: Missing Authentication for Critical Function within the context of session handling. The root cause lies in how the server validates the continuity of an authenticated state after initial credential submission. If the system does not strictly enforce that all required factors are validated against the specific user identity before granting access to resources, it creates a pathway for privilege escalation or unauthorized data exfiltration. An attacker who has obtained valid credentials for one account may be able to leverage this flaw to bypass MFA requirements when interacting with other accounts or services within the same instance, depending on how session tokens are generated and validated. This type of vulnerability is often referred to as a logical authentication bypass, where the cryptographic strength of the factors is irrelevant because the logic governing their application is flawed.
The operational impact of this vulnerability is severe for organizations relying on WS_FTP Server for secure file transfer operations over SSH protocols. By bypassing Multi-Factor Authentication, an attacker who has compromised user credentials through phishing, credential stuffing, or other means can gain full access to sensitive data without needing the second factor, such as a time-based one-time password or hardware key. This significantly lowers the barrier of entry for malicious actors and undermines the security posture established by implementing MFA. The vulnerability falls under the MITRE ATT&CK technique T1078: Valid Accounts, specifically within the sub-technique context where valid credentials are used to bypass additional authentication controls. It also relates to TA0004 (Privilege Escalation) if the attacker uses this access to move laterally or escalate privileges on the host system running the WS_FTP Server service.
Mitigation strategies must prioritize immediate patching and configuration review. The primary remediation is to upgrade Progress Software WS_FTP Server to version 2024.0.6 or later, where the vendor has addressed the improper association of authentication factors. Until patches are applied, organizations should implement compensating controls such as network-level access restrictions using firewalls to limit SSH port exposure only to trusted IP addresses. Additionally, enabling strict session timeout policies and monitoring for anomalous login patterns can help detect potential exploitation attempts. It is also advisable to review account configurations to ensure that no legacy or misconfigured accounts exist that might exploit this logic flaw. Regular audits of authentication logs should be conducted to identify any instances where MFA was not enforced during SSH sessions, providing visibility into whether the vulnerability has been exploited in the environment.