CVE-2026-84295

Published Oct 29, 2026

Last updated 8 days ago

CVSS critical 10.0
Port (21)

Overview

Description
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Source
security@progress.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@progress.com
CWE-287

Social media

Hype score
Not currently trending

  1. ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-61991 (CVSS: 10) CVE-2026-84295 (CVSS: 10) Progress Sof... CVE-2026-107327 (CVSS: 9.9) IBM CVE-2026-107328 (CVSS: 9.9) IBM CVE-2026-107329 (CVSS: 9.9) IBM ..🧵👇

    @exploitgrid

    30 Oct 2026

    61 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    1 Reply

    0 Quotes

  2. 🔥 CyberForge CVE of the Day #091 🚨 CVE-2026-84295 / CVE-2026-90868 — Progress WS_FTP Server: credential exposure and conditional command injection Administrator-credential exposure and command injection are an uncomfortable pairing on a file-transfer server. They requir

    @lee1981b

    30 Oct 2026

    147 Impressions

    1 Retweet

    3 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. #NØØT_Security_Alerts 🚨 #ALERT — Critical WS_FTP Authentication Bypass Exposes Administrative Credentials October 29, 2026 PRODUCT: Progress Software WS_FTP Server for Windows. CVE: CVE-2026-84295. SEVERITY: CRITICAL — CVSS 10.0. AFFECTED VERSIONS: Releases before 2024

    @Python_s_

    30 Oct 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🔴 Critical · Patched Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 CVE-2026-90868, CVE-2026-90865 +12 more https://t.co/hNhnltPJV4

    @pwnwatch_app

    29 Oct 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.•CVE-2026-90865
  2. An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.•CVE-2026-90868
  3. ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.•CVE-2026-63090
  4. Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.•CVE-2026-47729
  5. Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.•CVE-2026-49172

References

Sources include official advisories and independent security research.