{"id":"CVE-2026-84295","aliases":[],"cve":{"records":[{"id":"CVE-2026-84295","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-01T16:14:46.568Z","published":"2026-10-29T15:45:08.601Z","modified":"2026-10-30T17:18:25.542Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-10-29T15:45:08.601Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:25.542Z"}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-287","description":"CWE-287: Improper Authentication","source":"ProgressSoftware"},{"id":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","source":"ProgressSoftware"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T03:56:36.511377Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper Authentication in Progress WS_FTP Server","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.","score":10,"severity":"critical","published":"2026-10-29T15:45:08.601Z","modified":"2026-10-30T17:18:25.542Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"WS_FTP Server","platforms":["Windows"],"versions":[{"version":"0","status":"affected","lessThan":"2024.0.6","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2025.0.3","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-84295"}],"remediation":[{"text":"Contact Progress Software Technical Support for guidance on available mitigations.","source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-84295"}],"references":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"sources":[{"name":"CVE","id":"CVE-2026-84295","modified":"2026-10-30T17:18:25.542Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-84295"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10}],"sourceAffected":[],"observedAt":"2026-10-30T19:27:12.540Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T04:20:32.721Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T16:15:34.042Z","attemptedAt":"2026-10-29T16:15:34.042Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T16:15:33.545Z","attemptedAt":"2026-10-29T16:15:33.545Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T16:15:33.148Z","attemptedAt":"2026-10-29T16:15:33.148Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T16:15:32.732Z","attemptedAt":"2026-10-29T16:15:32.732Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113016","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113016","modified":"Oct 29, 2026, 3:45:08 PM","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-29T16:15:33.148Z"}],"aiSummary":{"text":"Progress WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows have an improper authentication weakness, potentially allowing unauthenticated remote attackers to access sensitive information. The required attacker access is remote. The stated impact includes access to administrative credentials.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:04:19.291Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-84295"}]}}