CVE-2026-84295 WS_FTP Server: Authentication Bypass

CVE-2026-84295 identifies an improper authentication flaw in Progress Software's WS_FTP Server, the file transfer server for Windows. An unauthenticated remote attacker can exploit this flaw to access sensitive information, including administrative credentials of the system. This represents direct access to system keys by an external actor without requiring any authentication.

The assigned CVSS score is 10.0, the maximum on the scale, classifying the flaw as critical. The vulnerability was published in the National Vulnerability Database on October 29, 2026. Social signals show 6 posts in the last 24 hours discussing the flaw, confirming immediate attention from the security community. Affected versions are clearly identified: WS_FTP Server prior to 2024.0.6 and 2025.0 prior to 2025.0.3 on Windows.

Priority defensive actions for system administrators are: immediately verify the installed version of WS_FTP Server; schedule the update to version 2024.0.6 or 2025.0.3 with maximum priority; review access logs and configuration files for signs of prior exploitation; restrict network access to the WS_FTP server until the update is complete. Patches are available and must be applied without delay.