Progress Fixes 10.0-Rated WS_FTP Server Flaw: Update to 2025.0.4
Progress has patched 15 WS_FTP Server flaws, including a maximum-severity authentication bug that can expose admin credentials. Here is what to update and how.
In this article
Progress Software has released security updates for its WS_FTP Server, a Windows file transfer product used by businesses to exchange files with partners and customers. One of the flaws carries the maximum severity score of 10.0. This article is for IT managers, system administrators and business owners who run WS_FTP Server or rely on a provider who does.
Key takeaways
- Progress released fixes for 15 WS_FTP Server vulnerabilities on 29 October 2026, six of them rated Critical.
- The worst, CVE-2026-84295, can let an unauthenticated remote attacker obtain sensitive information, including administrator credentials.
- Versions 2024.0.7 and 2025.0.4 fix all 15 issues. Earlier builds 2024.0.6 and 2025.0.3 fix only the first three.
- No exploitation has been confirmed so far, but file transfer servers are a favourite target, so update now.
What happened
On 29 October, Progress published patches for WS_FTP Server on Windows. The headline flaw, CVE-2026-84295, is an improper authentication weakness scored 10.0 on the CVSS 3.1 scale. According to the vendor’s description, an attacker who is not logged in could reach sensitive information such as administrative credentials and then use those credentials to get into the server’s management consoles. Once an attacker controls the admin side of a file transfer server, the files and user accounts on it are at risk.
The update addresses 14 other problems at the same time. Reports list six Critical, three High and six Medium issues in total.
The other critical flaws
- CVE-2026-90868 (9.9): an operating system command injection flaw on Windows.
- CVE-2026-90865 (9.0): a second command injection flaw.
- CVE-2026-90864 and CVE-2026-90866 (9.1 each): path traversal bugs that can let users write or change files they should not touch.
- CVE-2026-90863 (9.1): missing authorisation checks that can let a delegated host administrator go beyond their permitted scope.
Lower-rated fixes include an improper access control bug, another path traversal issue, two ways to bypass multi-factor authentication, two denial-of-service bugs and a flaw that could leak a password in cleartext.
Who is affected
The flaws affect WS_FTP Server running on Windows. Three of them (CVE-2026-84294, CVE-2026-84295 and CVE-2026-84296) affect versions before 2024.0.6 and 2025.0.3. The other twelve affect versions before 2024.0.7 and 2025.0.4. In practice, any organisation that has not updated since these releases should assume it is exposed.
This matters well beyond the companies that run the software themselves. Banks, logistics firms, healthcare providers and government contractors often swap large files with suppliers through managed file transfer services. If your organisation uploads payroll files, invoices or customer data to a partner’s FTP or SFTP portal, it is worth asking that partner whether they use WS_FTP and whether they have updated.
Do not forget servers that nobody actively manages. File transfer systems are often installed once for a single project or partner and then left running for years. Search your asset register, firewall rules and Windows server list for anything with “FTP” or “file transfer” in its name, and check old project servers and virtual machines. A forgotten, unpatched server is exactly the kind of system attackers look for.
Is it being exploited?
At the time of writing, there is no confirmed exploitation and no public proof-of-concept code, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Security reporting notes that attackers often target file transfer gateways early in an intrusion, because these systems sit at the edge of a network and hold valuable data. That is why a quiet period after disclosure should be used to patch, not to wait.
Why file transfer servers are high-value targets
File transfer servers are built to be reachable from outside the company. They store documents that criminals can sell or use for extortion, and they often hold login details for partners and automated systems. An authentication bypass on such a system is serious because it skips the first line of defence entirely. For organisations bound by data protection rules, including the Nigeria Data Protection Act, a breach of a file server holding personal data can also bring reporting duties and reputational damage.
What you should do
- Check your version. Confirm which WS_FTP Server build each of your servers runs.
- Update to the latest build. Download version 2025.0.4 or 2024.0.7 from the official Progress customer portal and install it. These builds fix all 15 issues, so do not stop at 2025.0.3 or 2024.0.6.
- Restrict the admin console. If you cannot update immediately, Progress advises limiting the administrative web consoles to your internal network. Better still, make this permanent: admin pages should never be open to the whole internet.
- Change administrator passwords after patching. Because the main flaw can expose admin credentials, rotate admin and service account passwords once the update is in place, and review MFA settings.
- Review logs and accounts. Look for unfamiliar admin logins, new users, changed permissions or unexpected large downloads in recent weeks.
- Ask your partners. If you exchange sensitive files through someone else’s WS_FTP server, ask them to confirm they have applied the update.
Patching one server today is far cheaper than investigating a data theft next month. Make this update part of this week’s change window.
Sources
Was this article helpful?
adminVerified expert
Cybersecurity Analyst — 20 years experience
Federal Capital Territory (Abuja)
Credentials: MCPN, MNCS, IAENG | System Analyst · Web Developer · CEH · CC · CDST
Got expertise to share? Write for us →
