CVE-2026-84295

{
  "etk_id": "ETK-2026-2983",
  "cve_id": "CVE-2026-84295",
  "display_id": "CVE-2026-84295",
  "ghsa_id": "GHSA-qwpp-fggf-7h3c",
  "euvd_id": "EUVD-2026-113016",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authentication in WS_FTP Server",
  "summary": "Progress Software WS_FTP Server on Windows before 2024.0.6 and 2025.0.3 is affected by an improper authentication flaw. An unauthenticated remote attacker could access sensitive information, including administrative credentials, when able to reach the affected server.",
  "mitigation": "Upgrade WS_FTP Server to 2024.0.6 or 2025.0.3, as applicable. Restrict network access to the server until the update is deployed.",
  "vendor": "Progress Software",
  "product": "WS_FTP Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2024.0.6",
        ">= 0, < 2025.0.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2024.0.6",
        "2025.0.3"
      ],
      "package_name": "WS_FTP Server",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.51478825,
  "t0_at": "2026-10-29T15:45:08.601000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T15:45:08.601000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T15:45:08.601000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84295"
    }
  }
}