Detections
Analytics

Progress WS_FTP Server < 9.0.6 / 10.0.x < 10.0.3 Multiple Vulnerabilities

critical Nessus Plugin ID 377013

Synopsis

An FTP server installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Progress WS_FTP Server installed on the remote Windows host is prior to 9.0.6 (2024.0.6), or is 10.0.x prior to 10.0.3 (2025.0.3). It is, therefore, affected by multiple vulnerabilities:

 - Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials. (CVE-2026-84295)

 - Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories. (CVE-2026-84294)

 - Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts. (CVE-2026-84296)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WS_FTP Server version 2024.0.6 (9.0.6) / 2025.0.3 (10.0.3) or later.

See Also

http://www.nessus.org/u?cc71c424

Plugin Details

Severity: Critical

ID: 377013

File Name: ws_ftp_server_2024_0_6_2025_0_3.nasl

Version: 1.2

Type: Local

Agent: windows

Family: FTP

Published: 11/6/2026

Updated: 11/6/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.86

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-84295

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:progress:ws_ftp_server

Required KB Items: installed_sw/Progress WS_FTP Server, SMB/Registry/Enumerated

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-84294, CVE-2026-84295, CVE-2026-84296

IAVA: 2026-A-1241