Progress WS_FTP Server Patches Seven Vulnerabilities, Including Credential Theft and DoS Flaws
Progress Software has released a service pack for its WS_FTP Server to address seven security vulnerabilities, ranging from credential theft and unauthorized file access to denial-of-service conditions.
Progress Software has issued a critical service pack for its WS_FTP Server, addressing a total of seven security vulnerabilities that could expose sensitive credentials, permit unauthorized access to files, and enable remote attackers to disrupt services. The update, recommended for all Windows installations of WS_FTP Server, brings the software to version 2025.0.5 (also known as 10.0.5).
The advisory details five high-severity vulnerabilities, with CVE-2026-115338 (CVSS 8.1) being a significant concern for the XFT service when operating over unencrypted HTTP. Attackers could exploit this flaw to intercept sensitive data or manipulate requests. Progress strongly advises disabling HTTP, enforcing HTTPS, invalidating active sessions, and rotating credentials that may have been transmitted insecurely until patching is complete.
Another critical flaw, CVE-2026-115340 (CVSS 7.1), discovered by researcher Momen Elmady, affects temporary files generated during file transfers. These files could inadvertently store user credentials and session information, posing a risk to any entity with access to them. While shortening session timeouts and restricting the Ad Hoc Transfer endpoint to trusted networks can mitigate exposure, these are temporary measures and do not replace the necessary update.
CVE-2026-115341 (CVSS 7.7), identified by Mateusz Mieczkowski, impacts the Thin Client Web Transfer functionality. This vulnerability could allow authenticated FTP users to access files outside their designated directories, leading to unauthorized data disclosure. While the advisory mentions file disclosure, a confirmed path traversal mechanism is not explicitly detailed.
Denial-of-service (DoS) risks are also present. CVE-2026-115339 (CVSS 7.5) allows an unauthenticated remote attacker to cause memory exhaustion in the XFT service due to insufficient resource limits. Progress suggests temporarily reducing message-size and array-size limits to the minimum required for normal operations as a workaround, though full remediation requires the update.
The fifth documented vulnerability, CVE-2026-35189 (CVSS 7.5), targets the OpenSSL certificate processing within WS_FTP Server. A malformed certificate with numerous relative certificate revocation list distribution points can trigger excessive memory usage, leading to a denial-of-service condition. This issue is relevant for packages using OpenSSL 3.5.8 when client-certificate requests are enabled, a setting that is off by default. The update to version 2025.0.5 also upgrades OpenSSL to 3.5.9.
While the article's headline mentions seven vulnerabilities and path traversal, the provided details focus on five specific CVEs and do not explicitly confirm path traversal for all issues. Administrators should consult the individual CVE descriptions for a precise understanding of the risks associated with each flaw. Progress emphasizes that workarounds only reduce exposure and that a full upgrade is necessary for complete remediation.
Organizations should plan for scheduled downtime to apply the update, as the upgrade process involves a service outage. Progress recommends obtaining the latest installers from their Community portal and carefully reviewing the vendor's upgrade guidance. Although the public release notes may not yet reflect the latest version, the documented risks necessitate prompt patching, particularly for environments with web transfer endpoints accessible from untrusted networks or where credentials may have been previously handled insecurely.