{"schema_version":1,"title":"Progress Software WS FTP Server vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Progress Software WS FTP Server: 4 in the last 7 days and 19 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115341, was published on 9 November 2026. 15 vulnerabilities in the last four weeks, up from none in the four before. 6 critical against 0.","url":"https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server","json_url":"https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":6,"all_time":19,"critical":6,"exploited":0,"last_7_days":4,"last_30_days":19,"last_90_days":19,"last_365_days":19},"latest":[{"cve":"CVE-2026-115341","cvss":7.7,"slug":"cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer","title":"Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer","severity":"high","exploited":false,"published_at":"2026-11-09T17:17:11.663+00:00","url":"https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer"},{"cve":"CVE-2026-115340","cvss":7.1,"slug":"cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on","title":"Progress Software WS_FTP Server sensitive data exposure in temp file","severity":"high","exploited":false,"published_at":"2026-11-09T17:17:11.52+00:00","url":"https://junglewise.ai/threats/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on"},{"cve":"CVE-2026-115339","cvss":7.5,"slug":"cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server denial of service via insufficient resource limits","severity":"high","exploited":false,"published_at":"2026-11-09T17:17:11.38+00:00","url":"https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-115336","cvss":6.5,"slug":"cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server","title":"Progress WS_FTP Server incorrect quota accounting","severity":"medium","exploited":false,"published_at":"2026-11-09T17:17:10.903+00:00","url":"https://junglewise.ai/threats/cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90872","cvss":6.6,"slug":"cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated","title":"Progress Software WS_FTP Server code injection in Manager web console","severity":"medium","exploited":false,"published_at":"2026-10-29T16:20:05.417+00:00","url":"https://junglewise.ai/threats/cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated"},{"cve":"CVE-2026-90871","cvss":5.3,"slug":"cve-2026-90871-improper-limitation-of-a-pathname-to-a-restricted-directory-in","title":"Progress Software WS_FTP Server path traversal","severity":"medium","exploited":false,"published_at":"2026-10-29T16:20:05.307+00:00","url":"https://junglewise.ai/threats/cve-2026-90871-improper-limitation-of-a-pathname-to-a-restricted-directory-in"},{"cve":"CVE-2026-90870","cvss":5.3,"slug":"cve-2026-90870-a-missing-release-of-backend-receiver-sessions-in-the-ad-hoc","title":"Progress WS_FTP Server resource exhaustion in Ad Hoc Transfer","severity":"medium","exploited":false,"published_at":"2026-10-29T16:20:05.19+00:00","url":"https://junglewise.ai/threats/cve-2026-90870-a-missing-release-of-backend-receiver-sessions-in-the-ad-hoc"},{"cve":"CVE-2026-90869","cvss":7.5,"slug":"cve-2026-90869-a-remote-attacker-who-knows-a-valid-account-s-enrolled-ssh-public","title":"Progress WS_FTP Server SSH service DoS","severity":"high","exploited":false,"published_at":"2026-10-29T16:20:05.08+00:00","url":"https://junglewise.ai/threats/cve-2026-90869-a-remote-attacker-who-knows-a-valid-account-s-enrolled-ssh-public"},{"cve":"CVE-2026-90868","cvss":9.9,"slug":"cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp","title":"Progress Software WS_FTP Server OS command injection on Windows","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.963+00:00","url":"https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp"},{"cve":"CVE-2026-90867","cvss":8.1,"slug":"cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress","title":"Progress WS_FTP Server improper access control in Web Admin console","severity":"high","exploited":false,"published_at":"2026-10-29T16:20:04.827+00:00","url":"https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress"},{"cve":"CVE-2026-90866","cvss":9.1,"slug":"cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server path traversal","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.69+00:00","url":"https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90865","cvss":9,"slug":"cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp","title":"Progress WS_FTP Server OS command injection on Windows","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.57+00:00","url":"https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp"},{"cve":"CVE-2026-90864","cvss":9.1,"slug":"cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server path traversal","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.453+00:00","url":"https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90863","cvss":9.1,"slug":"cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress","title":"Progress WS_FTP Server missing authorization in admin interface","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.337+00:00","url":"https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress"},{"cve":"CVE-2026-90862","cvss":4.3,"slug":"cve-2026-90862-improper-authentication-in-the-web-transfer-module-of-progress","title":"Progress Software WS_FTP Server multi-factor authentication bypass","severity":"medium","exploited":false,"published_at":"2026-10-29T16:20:04.22+00:00","url":"https://junglewise.ai/threats/cve-2026-90862-improper-authentication-in-the-web-transfer-module-of-progress"},{"cve":"CVE-2026-90861","cvss":6.6,"slug":"cve-2026-90861-progress-software-ws-ftp-server-versions-prior-to-2024-0-7-and","title":"Progress Software WS_FTP Server password exposure to administrators","severity":"medium","exploited":false,"published_at":"2026-10-29T16:20:04.097+00:00","url":"https://junglewise.ai/threats/cve-2026-90861-progress-software-ws-ftp-server-versions-prior-to-2024-0-7-and"},{"cve":"CVE-2026-84296","cvss":6.8,"slug":"cve-2026-84296-multi-factor-authentication-bypass-vulnerability-in-ssh-component","title":"Progress Software WS_FTP Server MFA bypass in SSH","severity":"medium","exploited":false,"published_at":"2026-10-29T16:19:29.98+00:00","url":"https://junglewise.ai/threats/cve-2026-84296-multi-factor-authentication-bypass-vulnerability-in-ssh-component"},{"cve":"CVE-2026-84295","cvss":10,"slug":"cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server authentication bypass","severity":"critical","exploited":false,"published_at":"2026-10-29T16:19:29.86+00:00","url":"https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-84294","cvss":7.7,"slug":"cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component","title":"Progress Software WS_FTP Server path traversal in Ad Hoc Transfer","severity":"high","exploited":false,"published_at":"2026-10-29T16:19:29.237+00:00","url":"https://junglewise.ai/threats/cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":6,"exploited":0,"vulnerabilities":15},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":4}],"related":[{"name":"Progress Software UI for ASP.NET AJAX","slug":"ui-for-asp-net-ajax","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/ui-for-asp-net-ajax"},{"name":"Progress Software KendoReact","slug":"kendoreact","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/kendoreact"},{"name":"Progress Software MOVEit Automation","slug":"moveit-automation","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/moveit-automation"},{"name":"Progress Software Kendo UI for Angular","slug":"kendo-ui-for-angular","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/kendo-ui-for-angular"}],"technology":{"hub":true,"name":"Progress Software WS FTP Server","slug":"progress-software-ws-ftp-server","vendor":{"hub":true,"name":"Progress Software","slug":"progress-software","url":"https://junglewise.ai/threats/vendors/progress-software"},"aliases":[],"category":"appliance","homepage":"https://www.progress.com/ws_ftp","description":"FTP server software for secure file transfer and management.","url":"https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server"},"most_severe":[{"cve":"CVE-2026-84295","cvss":10,"slug":"cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server authentication bypass","severity":"critical","exploited":false,"published_at":"2026-10-29T16:19:29.86+00:00","url":"https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90868","cvss":9.9,"slug":"cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp","title":"Progress Software WS_FTP Server OS command injection on Windows","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.963+00:00","url":"https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp"},{"cve":"CVE-2026-90866","cvss":9.1,"slug":"cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server path traversal","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.69+00:00","url":"https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90864","cvss":9.1,"slug":"cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server path traversal","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.453+00:00","url":"https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server"},{"cve":"CVE-2026-90863","cvss":9.1,"slug":"cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress","title":"Progress WS_FTP Server missing authorization in admin interface","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.337+00:00","url":"https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress"},{"cve":"CVE-2026-90865","cvss":9,"slug":"cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp","title":"Progress WS_FTP Server OS command injection on Windows","severity":"critical","exploited":false,"published_at":"2026-10-29T16:20:04.57+00:00","url":"https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp"},{"cve":"CVE-2026-90867","cvss":8.1,"slug":"cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress","title":"Progress WS_FTP Server improper access control in Web Admin console","severity":"high","exploited":false,"published_at":"2026-10-29T16:20:04.827+00:00","url":"https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress"},{"cve":"CVE-2026-115341","cvss":7.7,"slug":"cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer","title":"Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer","severity":"high","exploited":false,"published_at":"2026-11-09T17:17:11.663+00:00","url":"https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer"},{"cve":"CVE-2026-84294","cvss":7.7,"slug":"cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component","title":"Progress Software WS_FTP Server path traversal in Ad Hoc Transfer","severity":"high","exploited":false,"published_at":"2026-10-29T16:19:29.237+00:00","url":"https://junglewise.ai/threats/cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component"},{"cve":"CVE-2026-115339","cvss":7.5,"slug":"cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server","title":"Progress Software WS_FTP Server denial of service via insufficient resource limits","severity":"high","exploited":false,"published_at":"2026-11-09T17:17:11.38+00:00","url":"https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server"}],"generated_at":"2026-11-09T18:07:00.162565+00:00"}