WS_FTP Server (< 2025.0.5) - CraftedSignal Threat Feed

Progress Software WS_FTP Server: Denial of service via insufficient resource limits (CVE-2026-115339)

hello@craftedsignal.io — Mon, 09 Nov 2026 21:59:11 +0000

Progress Software WS_FTP Server versions prior to 2025.0.5 contain a vulnerability regarding insufficient resource limits. This flaw allows an unauthenticated remote attacker to cause a denial of service (DoS) on affected Windows-based systems. As of this report, the specific mechanics of the resource exhaustion (e.g., connection flooding or memory exhaustion) have not been detailed by the vendor or NVD.

Impact

Successful exploitation results in a denial of service, rendering the WS_FTP service unresponsive to legitimate users.

Recommendation

Patch affected systems by upgrading to WS_FTP Server version 2025.0.5 or later.
Audit internet-facing WS_FTP Server instances to ensure they are not accessible to unauthorized networks until patching is completed.
Monitor service logs for an anomalous spikes in connection requests or sudden service termination events that may indicate exploitation attempts.

Progress Software WS_FTP Server: Path traversal in Thin Client Web Transfer (CVE-2026-115341)

hello@craftedsignal.io — Mon, 09 Nov 2026 19:57:07 +0000

Progress Software WS_FTP Server versions prior to 2025.0.5 contain a vulnerability in the Thin Client Web Transfer component. An authenticated user can exploit improper access restrictions to access files outside of their designated directory boundaries. This vulnerability is assigned CVE-2026-115341.

Impact

Authenticated attackers may gain unauthorized access to sensitive files on the underlying Windows filesystem that are otherwise restricted by the application configuration.

Recommendation

Update Progress Software WS_FTP Server to version 2025.0.5 or later. Organizations should monitor Thin Client Web Transfer logs for directory traversal patterns such as "../" sequences in request paths from authenticated user sessions.

Progress Software WS_FTP Server: Sensitive credential and session data exposure (CVE-2026-115340)

hello@craftedsignal.io — Mon, 09 Nov 2026 17:50:28 +0000

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

Progress WS_FTP Server: Insufficient protection of communications (CVE-2026-115338)

hello@craftedsignal.io — Mon, 09 Nov 2026 17:50:18 +0000

Progress WS_FTP Server versions prior to 2025.0.5 contain a vulnerability where communications are insufficiently protected. This flaw allows a network attacker positioned to observe or intercept traffic to conduct man-in-the-middle attacks. An attacker can intercept sensitive information or modify requests if the server is configured to allow or fall back to unencrypted connections.

Impact

Successful exploitation allows for the interception of sensitive data transmitted over the network and the modification of client-to-server requests, potentially compromising credentials or file transfer integrity.

Recommendation

Patch Progress WS_FTP Server to version 2025.0.5 or later immediately.
Audit WS_FTP Server configurations to disable support for unencrypted connections (e.g., ensure mandatory TLS/SSL usage for all listeners).
Inventory all internet-facing instances of Progress WS_FTP Server.