[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ-3lVknQSfcW7kIfd6TX2asFxaLIPBt7ZTGq4ZCMkKY":3},{"article":4,"iocs":44,"watch_terms":61,"solutions":62,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"baf7efae-fed5-455c-8411-2c0e99c7fcb6","Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks","progress-ws-ftp-server-fixes-7-security-flaws-allowing-credential-theft-path-tra-681854","Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers. The company recommends upgrading Windows installations to WS_FTP Server 2025.0.5, also identified as version 10.0.5. The November 9 advisory supplied for this report describes […] The post Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks appeared first on Cyber Security News.","Progress Software has released a service pack for WS_FTP Server to address seven security vulnerabilities. These flaws could lead to credential exposure, unauthorized file access, and remote attacks. The company recommends upgrading to version 2025.0.5 to mitigate these risks, noting that workarounds are temporary.","Progress WS_FTP Server patched 7 security flaws including credential theft and remote attacks.","https:\u002F\u002Fcybersecuritynews.com\u002Fprogress-ws_ftp-server-fixes-security-vulnerabilities\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FProgress-WS_FTP-Server-Fixes-7-Security-Vulnerabilities-Allowing-Credential-Theft-Path-Traversal-and-Remote-Attacks.webp","2026-11-10T08:42:39+00:00","2026-11-10T09:00:30.523674+00:00",8,[17,20,23],{"name":18,"type":19},"WS_FTP Server","product",{"name":21,"type":22},"Progress Software","vendor",{"name":24,"type":25},"OpenSSL","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,52,55,58],{"type":46,"value":47,"context":48},"cve","CVE-2026-115338","Affects XFT service with unencrypted HTTP, allowing sensitive information interception or request modification.",{"type":46,"value":50,"context":51},"CVE-2026-115340","Concerns temporary files created during transfers that may contain user credentials and session data.",{"type":46,"value":53,"context":54},"CVE-2026-115341","Weak access restrictions in Thin Client Web Transfer could allow authenticated users to read unintended files.",{"type":46,"value":56,"context":57},"CVE-2026-115339","Allows unauthenticated remote attackers to exhaust XFT memory due to insufficient resource limits.",{"type":46,"value":59,"context":60},"CVE-2026-35189","Affects OpenSSL certificate processing, potentially causing denial of service via excessive memory use with many revocation list distribution points.",[21,18],{"controls":63,"vendors":132},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,102,110],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":94,"product_name":99,"url":100,"description":101},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[123,124],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"wsftp-server-flaws-enable-credential-theft-and-remote-attacks-without-patching","WS_FTP Server Flaws Enable Credential Theft and Remote Attacks Without Patching","Progress Software's WS_FTP Server contained seven vulnerabilities — including credential exposure, path traversal, and remote attack vectors — that remained exploitable until a service pack was released. Organizations running unpatched versions of this widely-used file transfer server were exposed to significant data theft and system compromise risks. File transfer software is a high-value target for attackers because it sits at the boundary of sensitive data flows, making timely patching critical. The vendor's own note that workarounds are only temporary underscores that there is no substitute for applying the official update promptly.",[138,139,140,141,142,143,144],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":146,"PCI DSS Requirement 6":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"OWASP A06:2021 Vulnerable and Outdated Components":149,"CIS Control 7: Continuous Vulnerability Management":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"NIS2 obligates essential and important entities to implement incident handling and vulnerability management practices, including timely patching of internet-facing services such as WS_FTP Server.","If WS_FTP Server handles payment-related file transfers, PCI DSS Requirement 6 mandates that all system components and software are protected from known vulnerabilities by installing applicable security patches.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; applying this control would have mandated timely installation of the WS_FTP service pack.","Running WS_FTP Server versions below 2025.0.5 is a textbook instance of using a vulnerable, outdated component — the exact risk OWASP A06 warns organizations to monitor and remediate continuously.","Regular, automated vulnerability scanning would have flagged the unpatched WS_FTP Server instances and triggered a remediation workflow before attackers could exploit the credential theft or path traversal flaws.","This control explicitly requires organizations to track and remediate technical vulnerabilities in a timely manner, directly addressing the failure to patch WS_FTP Server against the seven disclosed flaws.","The credential exposure vulnerability in WS_FTP Server highlights the need for strong identity and access controls around file transfer services to limit the blast radius of stolen credentials."]