WS_FTP Server vulnerabilities and CVEs

Known vulnerabilities affecting WS_FTP Server, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

7 vulnerabilities tracked.

8.1 Insufficient protection of communications in Progress WSFTP Server versions prior to 2025.0.5 could allow a network attacker to intercept… CVE-2026-115338 9 Nov 2026
7.7 Improper access restrictions in the Thin Client Web Transfer component of Progress Software WSFTP Server versions prior to 2025.0.5 on… CVE-2026-115341 9 Nov 2026
7.7 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3… CVE-2026-84294 29 Oct 2026
7.5 Insufficient resource limits in Progress Software WSFTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote… CVE-2026-115339 9 Nov 2026
7.1 Progress Software WSFTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary… CVE-2026-115340 9 Nov 2026
6.5 Incorrect quota accounting in Progress Software WSFTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with… CVE-2026-115336 9 Nov 2026
6.3 Improper access control in Progress WSFTP Server versions prior to 2025.0.5 could allow an authenticated user with certain… CVE-2026-115337 9 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that WS_FTP Server is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here