# CVE-2026-84296: Progress Software WS_FTP Server MFA bypass in SSH

Source: https://junglewise.ai/threats/cve-2026-84296-multi-factor-authentication-bypass-vulnerability-in-ssh-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-84296 · Severity: medium · CVSS 6.8 · Published 2026-10-29

Progress WS_FTP Server is a file transfer service used by organizations to securely exchange files over SSH. Authenticated users can bypass multi-factor authentication requirements through improper handling of authentication factors, allowing an attacker with a valid account to gain unauthorized access without providing a second authentication factor. This affects versions prior to 2024.0.6 and 2025.0.3 on Windows systems.

Technologies: [Progress Software WS FTP Server](https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server). Vendors: [Progress Software](https://junglewise.ai/threats/vendors/progress-software).

## Quick answers

**Is CVE-2026-84296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84296 being exploited in the wild.

**How severe is CVE-2026-84296?** Medium severity, with a CVSS score of 6.8, published 29 October 2026.

**Which products and versions are affected?** Progress Software WS FTP Server prior to 2024.0.6 and 2025.0.3.

**Is there a fix for CVE-2026-84296?** Yes: fixed in 2024.0.6, 2025.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84296 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-84296?** Check whether you run Progress Software WS FTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2024.0.6, 2025.0.3

## Technical details

The SSH component in WS_FTP Server improperly associates authentication factors between accounts, allowing bypass of MFA controls. An authenticated attacker can exploit this vulnerability to skip multi-factor authentication verification. The vulnerability affects versions prior to 2024.0.6 (2024 branch) and 2025.0.3 (2025 branch) on Windows.

## Affected products

- Progress Software WS_FTP Server prior to 2024.0.6 and 2025.0.3

## Timeline

- 2026-10-29: disclosed

## References

- [https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view](https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view)

## Related threats

- [Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer](https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer)
- [Progress Software WS_FTP Server sensitive data exposure in temp file](https://junglewise.ai/threats/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on)
- [Progress Software WS_FTP Server denial of service via insufficient resource limits](https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server)
- [Progress WS_FTP Server incorrect quota accounting](https://junglewise.ai/threats/cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server)
- [Progress Software WS_FTP Server code injection in Manager web console](https://junglewise.ai/threats/cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated)