{"id":"CVE-2026-115340","aliases":[],"cve":{"records":[{"id":"CVE-2026-115340","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-22T10:41:52.792Z","published":"2026-11-09T16:47:31.408Z","modified":"2026-11-12T16:47:58.302Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-11-09T16:47:31.408Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T16:47:58.302Z"}],"references":[{"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312: Cleartext Storage of Sensitive Information","source":"ProgressSoftware"},{"id":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","source":"ProgressSoftware"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T16:47:38.585254Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.","score":7.1,"severity":"high","published":"2026-11-09T16:47:31.408Z","modified":"2026-11-12T16:47:58.302Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"WS_FTP Server","platforms":["Windows"],"versions":[{"version":"0","status":"affected","lessThan":"2025.0.5","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-115340"}],"remediation":[{"text":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.","source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-115340"}],"references":["https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"],"sources":[{"name":"CVE","id":"CVE-2026-115340","modified":"2026-11-12T16:47:58.302Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115340"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-13T05:56:55.344Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-09T17:00:37.755Z","attemptedAt":"2026-11-09T17:00:37.755Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-09T17:00:37.776Z","attemptedAt":"2026-11-09T17:00:37.776Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-09T17:00:38.500Z","attemptedAt":"2026-11-09T17:00:38.500Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-09T17:00:37.601Z","attemptedAt":"2026-11-09T17:00:37.601Z"}],"evidence":[],"aiSummary":{"text":"Progress WS_FTP Server versions prior to 2025.0.5 on Windows may store sensitive credentials in a temporary file during transfers. Local access is required to exploit this weakness. The impact is cleartext storage of sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T17:01:06.572Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-115340"}]}}