# Progress Software WS FTP Server vulnerabilities Source: https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Progress Software WS FTP Server: 4 in the last 7 days and 19 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115341, was published on 9 November 2026. 15 vulnerabilities in the last four weeks, up from none in the four before. 6 critical against 0. ## Counts - Last 7 days: 4 - Last 30 days: 19 - Last 90 days: 19 - All time: 19 (6 critical, 0 exploited in the wild) ## About Progress Software WS FTP Server FTP server software for secure file transfer and management. ## Latest Progress Software WS FTP Server vulnerabilities - [CVE-2026-115341: Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer](https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer) (high, CVSS 7.7, published 9 Nov 2026) - [CVE-2026-115340: Progress Software WS_FTP Server sensitive data exposure in temp file](https://junglewise.ai/threats/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-115339: Progress Software WS_FTP Server denial of service via insufficient resource limits](https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-115336: Progress WS_FTP Server incorrect quota accounting](https://junglewise.ai/threats/cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server) (medium, CVSS 6.5, published 9 Nov 2026) - [CVE-2026-90872: Progress Software WS_FTP Server code injection in Manager web console](https://junglewise.ai/threats/cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated) (medium, CVSS 6.6, published 29 Oct 2026) - [CVE-2026-90871: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90871-improper-limitation-of-a-pathname-to-a-restricted-directory-in) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-90870: Progress WS_FTP Server resource exhaustion in Ad Hoc Transfer](https://junglewise.ai/threats/cve-2026-90870-a-missing-release-of-backend-receiver-sessions-in-the-ad-hoc) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-90869: Progress WS_FTP Server SSH service DoS](https://junglewise.ai/threats/cve-2026-90869-a-remote-attacker-who-knows-a-valid-account-s-enrolled-ssh-public) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-90868: Progress Software WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-90867: Progress WS_FTP Server improper access control in Web Admin console](https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-90866: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90865: Progress WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9, published 29 Oct 2026) - [CVE-2026-90864: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90863: Progress WS_FTP Server missing authorization in admin interface](https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90862: Progress Software WS_FTP Server multi-factor authentication bypass](https://junglewise.ai/threats/cve-2026-90862-improper-authentication-in-the-web-transfer-module-of-progress) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-90861: Progress Software WS_FTP Server password exposure to administrators](https://junglewise.ai/threats/cve-2026-90861-progress-software-ws-ftp-server-versions-prior-to-2024-0-7-and) (medium, CVSS 6.6, published 29 Oct 2026) - [CVE-2026-84296: Progress Software WS_FTP Server MFA bypass in SSH](https://junglewise.ai/threats/cve-2026-84296-multi-factor-authentication-bypass-vulnerability-in-ssh-component) (medium, CVSS 6.8, published 29 Oct 2026) - [CVE-2026-84295: Progress Software WS_FTP Server authentication bypass](https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server) (critical, CVSS 10, published 29 Oct 2026) - [CVE-2026-84294: Progress Software WS_FTP Server path traversal in Ad Hoc Transfer](https://junglewise.ai/threats/cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component) (high, CVSS 7.7, published 29 Oct 2026) ## Most severe Progress Software WS FTP Server vulnerabilities - [CVE-2026-84295: Progress Software WS_FTP Server authentication bypass](https://junglewise.ai/threats/cve-2026-84295-improper-authentication-in-progress-software-ws-ftp-server) (critical, CVSS 10, published 29 Oct 2026) - [CVE-2026-90868: Progress Software WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90868-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-90866: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90866-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90864: Progress Software WS_FTP Server path traversal](https://junglewise.ai/threats/cve-2026-90864-a-path-traversal-vulnerability-in-progress-software-ws-ftp-server) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90863: Progress WS_FTP Server missing authorization in admin interface](https://junglewise.ai/threats/cve-2026-90863-missing-authorization-in-the-administrative-interface-of-progress) (critical, CVSS 9.1, published 29 Oct 2026) - [CVE-2026-90865: Progress WS_FTP Server OS command injection on Windows](https://junglewise.ai/threats/cve-2026-90865-an-os-command-injection-vulnerability-in-progress-software-ws-ftp) (critical, CVSS 9, published 29 Oct 2026) - [CVE-2026-90867: Progress WS_FTP Server improper access control in Web Admin console](https://junglewise.ai/threats/cve-2026-90867-improper-access-control-in-the-web-admin-console-of-progress) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-115341: Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer](https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer) (high, CVSS 7.7, published 9 Nov 2026) - [CVE-2026-84294: Progress Software WS_FTP Server path traversal in Ad Hoc Transfer](https://junglewise.ai/threats/cve-2026-84294-improper-limitation-of-pathname-in-the-ad-hoc-transfer-component) (high, CVSS 7.7, published 29 Oct 2026) - [CVE-2026-115339: Progress Software WS_FTP Server denial of service via insufficient resource limits](https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server) (high, CVSS 7.5, published 9 Nov 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up from none in the four before. 6 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 15 | 6 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## Other Progress Software technologies - [Progress Software UI for ASP.NET AJAX](https://junglewise.ai/threats/technologies/ui-for-asp-net-ajax): 9 vulnerabilities - [Progress Software KendoReact](https://junglewise.ai/threats/technologies/kendoreact): 4 vulnerabilities - [Progress Software MOVEit Automation](https://junglewise.ai/threats/technologies/moveit-automation): 4 vulnerabilities - [Progress Software Kendo UI for Angular](https://junglewise.ai/threats/technologies/kendo-ui-for-angular): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progress Software WS FTP Server vulnerabilities", https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server, 9 November 2026.