Progress Software has rolled out a service pack in November 2026 that patches multiple serious vulnerabilities in WS_FTP Server—weaknesses that could expose login credentials, enable attackers to access sensitive files beyond their scope, or even allow remote disruptions of file transfers. Administrators using Windows installations are urged to upgrade to WS_FTP Server version 2025.0.5 (also labeled 10.0.5) to fully resolve these issues. Progress describes five high-severity Common Vulnerabilities and Exposures (CVEs) in its advisory, rated between 7.1 to 8.1. Notably, while early reports mentioned seven flaws and path traversal, the company’s details support only five validated issues. WS_FTP Server is widely used for secure file transfers, especially in enterprise settings.
The Critical Vulnerabilities Uncovered
One of the highest-rated flaws, CVE-2026-115338 (score 8.1), concerns the XFT service when connections are made over unencrypted HTTP. Attackers on the same network could intercept or alter requests and steal sensitive information. Until patching is complete, Progress recommends disabling HTTP, forcing HTTPS, expiring active sessions, and rotating any credentials that may have been exposed over unencrypted channels.
CVE-2026-115340 (rating 7.1) is tied to temporary files created during file transfers, which may hold user credentials and session data. An individual with access to these temporary areas could extract sensitive details. This bug was discovered by researcher Momen Elmady, also known as 0xmatrix.
CVE-2026-115341, with a rating of 7.7, affects the Thin Client Web Transfer feature. It allows authenticated FTP users to read files beyond their directory boundaries due to weak access restrictions—raising risk of file disclosure though not confirmed as full path traversal. The issue was reported by Mateusz Mieczkowski (referred to as rexnets).
CVE-2026-115339 scores 7.5 and permits unauthenticated remote attackers to cause memory exhaustion in the XFT service, exploiting insufficient resource limits. Progress recommends administrators temporarily reduce message-size and array-size limits based on guidance until the patch is deployed.
The fifth issue, CVE-2026-35189, also at a 7.5 severity, involves a flaw in OpenSSL certificate handling. When client-certificate requests are enabled—which is disabled by default—OpenSSL 3.5.8 (used in some WS_FTP packages) may suffer denial-of-service due to many relative certificate revocation list distribution points. Progress has updated OpenSSL to version 3.5.9 in the affected releases (2024.0.8 and 2025.0.5).
Mitigations & Urged Actions
While the full security fix requires applying the new installer (2025.0.5), Progress suggests temporary controls: restricting the Ad Hoc Transfer endpoint only to trusted networks, shortening session timeouts for XFT, disabling HTTP in favor of HTTPS, invalidating old sessions, and rotating possibly compromised credentials. For memory-based flaws, lowering certain configuration limits can reduce exposure.
The patch process will cause a service outage, so planning is required. The upgrade packages are available through the Progress Community portal, and users should strictly follow vendor guidance. Interestingly, the public release notes still show version 2025.0.4 as current, so users should verify the version list carefully.
No evidence of active exploitation of these vulnerabilities has surfaced yet. But given WS_FTP Server’s exposure—especially when web transfer endpoints are reachable from outside trusted networks or when credentials traveled over HTTP—the risks are nontrivial.
Bottom line: applying the official 2025.0.5 update is the only reliable way to eliminate all five known flaws; workarounds help reduce risk but are not sufficient.
Analytical angle: what makes this situation particularly concerning is the overlap of credential exposure, remote-code potential via resource exhaustion, and file-scope overreach—all in a trusted enterprise tool. This breakdown in boundary enforcement shows why defense in depth still matters: even if credentials are compromised or memory limits exceeded, properly segmented networks, strict access controls, and vigilant session management can limit damage. Watching whether WS_FTP vulnerabilities are exploited in the wild will be the key next chapter; organizations should assume heavy interest from threat actors now that the issue is public.
