CVE-2026-84295
CRITICAL · 10.0 EPSS 0.6%Recent critical advisory with patches released; no KEV/PoC yet but urgency warranted.
What: Improper authentication in Progress Software WS_FTP Server (versions <2024.0.6, <2025.0.3 on Windows) allows unauthenticated remote access to sensitive data including admin credentials. CVSS 10.0 CRITICAL.
Why it matters: Published yesterday; CVSS 10.0 severity and direct credential exposure make this high-priority for patching. No KEV listing yet, no confirmed PoC in posts, but Progress has issued patches (2024.0.6, 2025.0.3). Chatter emphasizes urgent patching need across multiple vendors.
Where it's seen: Cybersecurity news aggregators and social platforms amplifying NVD publication; posts link to vulnerability databases and patch guidance. Tone is alert-driven, not speculative—vendors already released fixes.
RISK: CRITICAL — CVSS 10.0, unauthenticated credential exposure, confirmed vendor patches available.
Description
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High