Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers.
The company recommends upgrading Windows installations to WS_FTP Server 2025.0.5, also identified as version 10.0.5. The November 9 advisory supplied for this report describes five high-severity CVEs. Although the requested headline refers to seven vulnerabilities and path traversal, the supplied details do not establish either claim.
Administrators should use the individual CVE descriptions to understand the risks rather than assume every issue allows the same attack.
CVE-2026-115338, rated 8.1, affects the XFT service when connections use unencrypted HTTP. A network attacker could intercept sensitive information or change requests sent to the service.
Until patching is complete, Progress recommends disabling HTTP, requiring HTTPS, invalidating active sessions, and rotating credentials known to have crossed unencrypted connections.
Another flaw, CVE-2026-115340, carries a 7.1 score and concerns temporary files created during file transfers. These files may contain user credentials and session data. Anyone with access could obtain sensitive information. Progress credits researcher Momen Elmady, known as 0xmatrix, with discovering the issue.
Progress WS_FTP Server Fixes Vulnerabilities
Temporary measures include shortening XFT session timeouts where practical and limiting the Ad Hoc Transfer endpoint to trusted networks when public access is unnecessary. These controls reduce exposure but do not replace the update.
CVE-2026-115341, rated 7.7, affects Thin Client Web Transfer. Weak access restrictions could allow an authenticated FTP user to read files outside their intended scope.
Researcher Mateusz Mieczkowski, known as rexnets, received discovery credit. The advisory describes file disclosure, without explaining a confirmed path traversal mechanism.
CVE-2026-115339 has a 7.5 score and allows an unauthenticated remote attacker to exhaust XFT memory because resource limits are insufficient. Administrators can temporarily lower message-size and array-size limits to the minimum needed for normal transfers, with configuration guidance from Progress support.
The fifth issue, CVE-2026-35189, affects OpenSSL certificate processing and also scores 7.5. A certificate containing many relative certificate revocation list distribution points can trigger excessive memory use and denial of service.
Within WS_FTP Server, this risk applies to affected packages containing OpenSSL 3.5.8 when client-certificate requests are enabled. That setting is turned off by default. Progress says releases 2024.0.8 and 2025.0.5 update OpenSSL to 3.5.9. Customers should not replace the bundled library independently.
The broader file-transfer threat remains relevant. Cybersecurity News previously covered active exploitation of Wing FTP Server, a separate product, and millions of internet-facing FTP servers. Neither report establishes exploitation of these WS_FTP flaws.
Progress recommends version 2025.0.5 to resolve all vulnerabilities listed in the supplied notice. The company says workarounds only reduce exposure and that remediation requires the full installer. Organizations should schedule downtime because the upgrade causes a service outage.
Customers should obtain installers through the Progress Community portal and review the vendor’s upgrade guidance. The public release-notes page retrieved for this report still lists 2025.0.4 as its newest entry, so it does not independently confirm the November fixes.
The supplied notice does not report active exploitation. Its documented risks still make patch planning important, especially where web transfer endpoints are reachable from untrusted networks or credentials may have previously traveled over HTTP.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
