{"id":"CVE-2026-84295","published":"2026-10-29T16:19:29.860","lastModified":"2026-10-30T04:18:25.237","description":"Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-287","CWE-522"],"vendors":[],"products":[],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Unauthenticated remote attackers can bypass authentication in affected WS_FTP Server versions to access sensitive information, including administrative credentials, due to improper authentication enforcement.","exploitability":"Exploitation is trivial for unauthenticated attackers as no prior access or user interaction is required.","blast_radius":"Successful exploitation could lead to full system compromise, including credential theft and unauthorized administrative control across all affected servers.","remediation":"Upgrade to WS_FTP Server version 2024.0.6 or 2025.0.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","credential-theft","web","windows"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:11:09.375Z"}}