Progress Software's WS_FTP Server has a batch of critical flaws, including a maximum-severity weakness that could let an unauthenticated attacker read sensitive information such as administrator credentials, according to CVE records published on Thursday. The worst flaw, tracked as CVE-2026-84295, carries a CVSS score of 10.0, the highest possible.

The records also list OS command injection flaws rated 9.9 and 9.0, tracked as CVE-2026-90868 and CVE-2026-90865, alongside several path-traversal and scope-escape issues rated 9.1 and a privilege-escalation flaw affecting delegated host administrators. All are fixed in WS_FTP Server versions 2024.0.7 and 2025.0.4, which were released on 1 October.

What administrators should do now

No exploitation of the new flaws has been reported, but security watchers warn against complacency: a major WS_FTP flaw in 2023 was mass-exploited within days of disclosure. Administrators should upgrade to the fixed versions, change administrator passwords afterwards, since the top flaw exposes credentials, and keep the Web Admin console off the public internet.

The flaws affect Windows versions of WS_FTP Server before the fixed releases. Organisations running older builds should treat the upgrade as urgent, particularly for any server reachable from the internet, where an unauthenticated attacker would need no login to reach the exposed data.

Sources: CVE-2026-84295 record and 29 October CVE threat brief.