CVE-2026-115338

{
  "etk_id": "ETK-2026-3975",
  "cve_id": "CVE-2026-115338",
  "display_id": "CVE-2026-115338",
  "ghsa_id": "GHSA-m75q-6rww-cvgg",
  "euvd_id": "EUVD-2026-120109",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Inadequate transport encryption in WS_FTP Server",
  "summary": "Progress WS_FTP Server versions earlier than 2025.0.5 are affected when connections are not encrypted. An attacker able to observe or interfere with network traffic could access sensitive information or modify requests.",
  "mitigation": "Upgrade WS_FTP Server to version 2025.0.5 or later. Require encrypted connections and restrict unencrypted service access until the upgrade is complete.",
  "vendor": "Progress Software",
  "product": "WS_FTP Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2025.0.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2025.0.5"
      ],
      "package_name": "WS_FTP Server",
      "purl": null
    }
  ],
  "cwes": [
    319
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 35.870262,
  "t0_at": "2026-11-09T16:42:41.548000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T18:35:03.023357+00:00",
      "days": 0.07802633515046296,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T16:42:41.548000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-09T16:42:41.548000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T16:42:41.548000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115338"
    }
  }
}