CVE-2026-84294— Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

Quick assessment

Affected

Progress Software WS_FTP Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Windows 系统上，Progress Software 公司 WS_FTP Server 的 Ad Hoc Transfer 组件中，对于路径名的限制存在不当之处。该问题影响 2024.0.6 之前的所有版本以及 2025.0.3 之前的所有版本，可能导致已认证用户访问目标目录之外的文件。

CVSS 7.7 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1565 · Data Manipulation T1083 · File and Directory Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

Source: CVE Program / CVE List V5

Vulnerability Description

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Progress Software	WS_FTP Server	0 ~ 2024.0.6	-

II. Public POCs for CVE-2026-84294

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-84294

请登录查看更多情报信息。

Other References for CVE-2026-84294 (1)

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-84294

Same Patch Batch · Progress Software · 2026-10-29 · 15 CVEs total

CVE-2026-84295	10.0 CRITICAL	Improper Authentication in Progress WS_FTP Server
CVE-2026-90868	9.9 CRITICAL	OS Command Injection in Progress WS_FTP Server
CVE-2026-90863	9.1 CRITICAL	Privilege Escalation via Missing Authorization in WS_FTP Manager
CVE-2026-90864	9.1 CRITICAL	Host Administrator Path Containment Bypass in Progress WS_FTP Server
CVE-2026-90866	9.1 CRITICAL	Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
CVE-2026-90865	9.0 CRITICAL	Command Injection via FTP Notification Variables in Progress WS_FTP Server
CVE-2026-90867	8.1 HIGH	Improper Access Control of Web Admin Console in Progress WS_FTP Server
CVE-2026-90869	7.5 HIGH	Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS
CVE-2026-84296	6.8 MEDIUM	SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
CVE-2026-90872	6.6 MEDIUM	Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
CVE-2026-90861	6.6 MEDIUM	Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FT
CVE-2026-90870	5.3 MEDIUM	Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
CVE-2026-90871	5.3 MEDIUM	Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS
CVE-2026-90862	4.3 MEDIUM	Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

IV. Related Vulnerabilities

Same product: WS_FTP Server

Same vendor: Progress Software

Same weakness: CWE-22