01 · The Real Story
A bank vault with a broken lock and the combination written on the wall
Progress WS_FTP Server versions before 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw in the web management or transfer interface. An unauthenticated remote attacker who can reach the service can request an endpoint that returns sensitive configuration data, including administrator credentials. No user interaction is required.
The vendor's CVSS 10 is not alarmist for the typical WS_FTP Server deployment. These systems usually sit in a DMZ specifically to exchange files with external parties, so they are internet-reachable by design. Stolen administrator credentials give an attacker full control of the server's file transfer jobs, stored files, and any linked backend shares or service accounts, making pre-auth credential disclosure a CRITICAL event.
Monday-morning action: treat this as CRITICAL; block external access to the WS_FTP web/admin listener immediately, apply the vendor patch within the *noisgate mitigation SLA* of 3 days, and complete fleet-wide patch and credential rotation within the *noisgate remediation SLA* of 90 days.
"Pre-auth admin credential theft on a DMZ file transfer server is every ransomware crew's opening move."
02 · The Attack Path
5 steps from start to impact.
STEP 01
Find an internet-reachable WS_FTP Server
The attacker first identifies a WS_FTP Server instance using search engines, TLS/HTTP banners, or product-specific paths. WS_FTP Server is commonly published to the internet because it is a managed file transfer service.
Conditions required:
- Network path to an exposed WS_FTP web/transfer listener
- No IP allowlists blocking the attacker's source
Where this breaks in practice:
- Some deployments restrict WS_FTP to internal networks or VPN concentrators
- Custom ports or non-default virtual host paths can reduce casual scanning
Detection/coverage: Shodan/Censys can fingerprint WS_FTP; GreyNoise would show scanning only after a public PoC appears
STEP 02
Reach the vulnerable unauthenticated endpoint
The attacker sends an HTTP request to the vulnerable endpoint without any session cookie or authentication header. The improper authentication check allows the request to be processed as if authenticated.
Conditions required:
- Unauthenticated network access to the affected web/admin listener
- Affected version before 2024.0.6/2025.0.3
Where this breaks in practice:
- Admin or configuration endpoints may be disabled in hardened builds
- Reverse proxy/WAF may block unusual paths, but a legitimate endpoint is often allowed
Detection/coverage: Standard HTTP access logs show requests; no exploit signature needed if the endpoint is a normal URI
STEP 03
Retrieve administrator credentials from the response
The vulnerable endpoint returns sensitive server configuration data, including administrator credentials, directly in the HTTP response body. The attacker receives username and password material without needing to crack hashes.
Conditions required:
- Credentials stored in a configuration file or response-accessible field
- No additional encryption beyond transport
Where this breaks in practice:
- Very little friction; this is the intended vulnerable behavior
Detection/coverage: DLP or response-inspection tools may catch credential patterns, but most HTTP inspection does not parse application bodies
STEP 04
Authenticate as administrator and take full control
Using the recovered credentials, the attacker logs in to the WS_FTP Server management interface and gains full administrative control. From there, the attacker can read, alter, or exfiltrate all managed files and reconfigure transfer jobs.
Conditions required:
- Admin interface reachable from attacker position
- No separate MFA or post-auth IP restriction on admin login
Where this breaks in practice:
- Some deployments enforce MFA on interactive admin logins, but service/config endpoints may bypass it
- If the admin interface is internal-only, the attacker needs to pivot through the DMZ first
Detection/coverage: Successful admin login after a suspicious unauthenticated request is an IOC; SIEM correlation can catch this
STEP 05
Pivot to connected storage and service accounts
WS_FTP Server usually stores credentials for backend file shares, cloud storage, or other systems. The attacker reuses those to move laterally, exfiltrate data, or establish persistent access to the managed file-transfer workflow.
Conditions required:
- Configuration contains linked storage/service credentials
- Network egress from WS_FTP host to backend systems permitted
Where this breaks in practice:
- Modern credential hygiene and least-privilege service accounts reduce blast radius
- Network segmentation between DMZ and internal storage can slow lateral movement
Detection/coverage: Endpoint EDR and SIEM can detect post-exploitation activity after the admin login, but not the initial credential theft
03 · Compensating Control
1
CRITICAL 9.5→MEDIUM 5.0
SEVERITY REDUCEDBlock external access to WS_FTP web/admin listeners — At the perimeter, restrict TCP ports for the WS_FTP management and web transfer interfaces to trusted internal IP ranges only. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL. This breaks the remote attacker condition but leaves internal network attackers able to exploit, so residual severity is MEDIUM.
2
CRITICAL 9.5→IGNORE 0.0
SEVERITY REDUCEDApply vendor patch 2024.0.6 / 2025.0.3 — Patch immediately; it removes the improper authentication bug. Treat as the permanent fix within the noisgate remediation SLA of 90 days. After patching, residual severity is IGNORE for this CVE.
3
CRITICAL 9.5→HIGH 7.5
SEVERITY REDUCEDRotate WS_FTP admin and linked service-account credentials — Assume credentials were exposed; rotate the WS_FTP administrative account, any stored transfer credentials, and linked domain/service accounts after patching. This limits the blast radius of any credential already copied. As a standalone control with the vulnerable endpoint still reachable, new credentials can be re-stolen, so residual severity remains HIGH.
What doesn't work
- WAF signature blocking: The request may look like a normal unauthenticated GET to a legitimate path; WAFs will not reliably distinguish it from legitimate traffic.
- Enabling MFA on WS_FTP admin accounts: If the vulnerability returns stored credentials and allows the attacker to authenticate through the same bypassed path, interactive MFA is not involved and can be bypassed.
- File integrity monitoring / AV: This is a network-level credential disclosure, not a code execution event on the host; endpoint controls will not see the initial theft.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild status | Not observed in the wild at disclosure; not listed in CISA KEV as of 2026-10-30. |
|---|---|
| Proof-of-concept availability | No public PoC identified on GitHub, ExploitDB, or PoCIndex in the immediate disclosure window; the simple auth bypass will be trivially reproducible once the patch diff is examined. |
| EPSS score / percentile | EPSS not yet scored for this CVE at assessment time; expect low initial EPSS to rise within days given the pre-auth credential disclosure. |
| KEV status | Not in CISA KEV; check again after the first exploitation reports. |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network attack, low complexity, no privileges, no user interaction, high confidentiality/integrity/availability impact with scope change. |
| Affected versions | WS_FTP Server prior to 2024.0.6 on the 2024 line and prior to 2025.0.3 on the 2025 line on Windows. |
| Fixed versions | 2024.0.6 and 2025.0.3; consult Progress for backport or distro-specific builds. |
| Exposure / scanning | Shodan and Censys historically show thousands of internet-exposed WS_FTP Server instances; exact post-disclosure counts not yet published. |
| Disclosure date | 2026-10-29 |
| Reporting researcher/org | Undisclosed; Progress Software credited the find internally or via a coordinated disclosure not yet named. |
Sources.
05 · The Call
Final Verdict
= UNCHANGED to CRITICAL (9.5/10)
Why this verdict
- Pre-auth credential disclosure: The flaw returns administrator credentials to an unauthenticated attacker; that alone is CRITICAL.
- Minimal real-world friction: WS_FTP Server is an MFT appliance commonly internet-facing by design, so the attacker position is already satisfied for a material share of installs.
- Role multiplier: Internet-facing file-transfer gateways are high-value: admin control over MFT can expose regulated files, linked storage credentials, and domain service accounts.
- Vendor baseline justified but slightly tempered: CVSS 10 assumes every instance is exposed and no compensating network segmentation; we trim to 9.5 for internal-only deployments and no observed exploitation.
Why not higher?
Score cannot exceed 10. The only reasons not to stay at 10 are that a meaningful minority of WS_FTP deployments restrict the vulnerable listener to internal networks or VPNs, and there is no confirmed in-the-wild exploitation or KEV listing yet. Those are configuration and temporal factors, not a fix for the flaw.
Why not lower?
This is a textbook unauthenticated credential disclosure on a DMZ system. Administrative credentials turn a single vulnerable web endpoint into full control of the MFT workload and often a pivot into linked storage or Active Directory. Any lower severity would understate the Monday-morning risk to enterprises that expose WS_FTP to partners.
06 · Verification
Crowdsourced verification payload.
Run on the WS_FTP Server host as an administrator. Open an elevated PowerShell prompt and run powershell -ExecutionPolicy Bypass -File .\check_cve-2026-84295.ps1. No arguments needed; exit 0 means PATCHED, 1 means VULNERABLE, 2 means UNKNOWN.
# check_cve-2026-84295.ps1
$ErrorActionPreference = 'SilentlyContinue'
function Test-WsftpAffected([string]$versionString) {
$v = $versionString.Trim()
if ($v -match '^[vV]?(\d+)\.(\d+)\.(\d+)') {
$major = [int]$matches[1]
$minor = [int]$matches[2]
$patch = [int]$matches[3]
$num = $major * 10000 + $minor * 100 + $patch
$fixed2024 = 2024 * 10000 + 0 * 100 + 6
$fixed2025 = 2025 * 10000 + 0 * 100 + 3
if ($major -lt 2024) { return $true }
if ($major -eq 2024 -and $num -lt $fixed2024) { return $true }
if ($major -eq 2025 -and $num -lt $fixed2025) { return $true }
return $false
}
return $null
}
$rootPaths = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$found = $false
Get-ItemProperty $rootPaths |
Where-Object { $_.DisplayName -match 'WS_FTP\s+Server' } |
ForEach-Object {
$found = $true
$display = $_.DisplayName
$version = $_.DisplayVersion
if (-not $version) {
Write-Output "UNKNOWN: $display installed but DisplayVersion is empty"
exit 2
}
$affected = Test-WsftpAffected $version
if ($affected -eq $null) {
Write-Output "UNKNOWN: cannot parse version '$version' for $display"
exit 2
}
if ($affected) {
Write-Output "VULNERABLE: $display version $version is affected by CVE-2026-84295"
exit 1
}
else {
Write-Output "PATCHED: $display version $version is not affected"
exit 0
}
}
if (-not $found) {
Write-Output "UNKNOWN: WS_FTP Server not found in registry uninstall keys"
exit 2
}