Progress WS_FTP Server: Insufficient protection of communications (CVE-2026-115338)
Progress WS_FTP Server versions prior to 2025.0.5 are vulnerable to man-in-the-middle attacks, allowing network attackers to intercept or modify traffic when unencrypted connections are permitted.
CVE search metadata
CVE search record: CVE-2026-115338. Severity: high. CVSS: 8.1. KEV: no. Product: WS_FTP Server (< 2025.0.5). Brief: Progress WS_FTP Server: Insufficient protection of communications (CVE-2026-115338). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ws-ftp-insecure-comm/
Triage facts
Revision 1- Applicability
- WS_FTP Server (< 2025.0.5)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 17:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Progress WS_FTP Server versions prior to 2025.0.5 contain a vulnerability where communications are insufficiently protected. This flaw allows a network attacker positioned to observe or intercept traffic to conduct man-in-the-middle attacks. An attacker can intercept sensitive information or modify requests if the server is configured to allow or fall back to unencrypted connections.
Impact
Successful exploitation allows for the interception of sensitive data transmitted over the network and the modification of client-to-server requests, potentially compromising credentials or file transfer integrity.
Recommendation
- Patch Progress WS_FTP Server to version 2025.0.5 or later immediately.
- Audit WS_FTP Server configurations to disable support for unencrypted connections (e.g., ensure mandatory TLS/SSL usage for all listeners).
- Inventory all internet-facing instances of Progress WS_FTP Server.
Immediate actions
Patch WS_FTP Server to 2025.0.5 or later
Threat Hunt
Identify WS_FTP Server instances configured to accept non-TLS traffic
Data: Server listener configuration logs, Application audit logs
Mitigations
Disable unencrypted listeners
CVE-2026-115338