Progress WS_FTP: critical vulnerabilities can lead to server compromise

What happened

On 2 November 2026, Progress reported several critical vulnerabilities in its file transfer software WS_FTP. According to the report, the flaws can lead to compromise of the server running WS_FTP. Progress has released updates and advises administrators to apply them quickly.

The available information does not include technical details, individual CVE IDs or the exact affected and fixed versions. There are no reports of active attacks so far. File transfer servers are often reachable from the internet and hold sensitive data, so they are a common target once details become known.

Who is affected

You are affected if you or your customers run Progress WS_FTP. This applies in particular to installations that can be reached from the internet. To find out which versions are affected and which versions contain the fix, check the vendor advisory and the report linked below.

What to do now

1. Find all installations. List every server where Progress WS_FTP is installed, including installations you run for customers, and note the installed version.
2. Compare with the advisory. Check the Progress advisory and the report linked below to see whether your version is affected and which version fixes the vulnerabilities.
3. Back up first. Back up the WS_FTP configuration and, if possible, take a snapshot of the server before you update.
4. Install the update. Apply the update provided by Progress, following the vendor's instructions.
5. Restart and verify. Make sure the WS_FTP services are running again after the update, and test a login and a file transfer.
6. Limit exposure. If you cannot update right away, restrict access to WS_FTP at the firewall to known IP addresses, and do not expose administrative interfaces to the internet.

How to check whether you are affected

• Check the installed WS_FTP version on each server and compare it with the fixed versions named in the vendor advisory.
• Review the WS_FTP and Windows event logs for unusual activity: logins from unknown IP addresses, failed login bursts, or unexpected errors.
• Look for user or administrator accounts in WS_FTP and on the system that you did not create.
• Check for unknown files in directories used by WS_FTP and for unexpected processes or scheduled tasks on the server.

If you find signs of compromise, isolate the server, preserve the logs for analysis, and change the credentials stored on or used by the server.

Sources

• https://www.heise.de/news/Sicherheitsluecken-in-Progress-WS-FTP-ermoeglichen-Kompromittierung-11507580.html