# CVE-2026-115338: Progress WS_FTP Server insufficient encryption in communications

Source: https://junglewise.ai/threats/cve-2026-115338-insufficient-protection-of-communications-in-progress-ws-ftp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-115338 · Severity: high · CVSS 8.1 · Published 2026-11-09

Progress WS_FTP Server is an enterprise file transfer service used to securely exchange files across organizations. Versions before 2025.0.5 allow attackers on the network to intercept sensitive data or modify file transfer requests when unencrypted connections are used, risking data theft or file tampering.

Technologies: [Progress WS FTP Server](https://junglewise.ai/threats/technologies/ws-ftp-server). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-115338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115338 being exploited in the wild.

**How severe is CVE-2026-115338?** High severity, with a CVSS score of 8.1, published 9 November 2026.

**Which products and versions are affected?** Progress WS FTP Server prior to 2025.0.5.

**Is there a fix for CVE-2026-115338?** Yes: fixed in 2025.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115338 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115338?** Check whether you run Progress WS FTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2025.0.5

## Technical details

The vulnerability stems from insufficient protection of communications in WS_FTP Server, permitting network-based interception of sensitive information or request modification over unencrypted connections. An unauthenticated network attacker can exploit this by positioning themselves to intercept traffic. A fix is available in version 2025.0.5 and later.

## Affected products

- Progress WS_FTP Server prior to 2025.0.5

## Timeline

- 2026-11-09: disclosed

## References

- [https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026](https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026)

## Related threats

- [Progress WS_FTP Server access control bypass](https://junglewise.ai/threats/cve-2026-115337-improper-access-control-in-progress-ws-ftp-server-versions-prior)
- [Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability](https://junglewise.ai/threats/cve-2023-40044-progress-ws-ftp-server-deserialization-of-untrusted-data)