Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks

What happened?

Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers. The company recommends upgrading Windows installations to WS_FTP Server 2025.0.5, also identified as version 10.0.5. The November 9 advisory supplied for this report describes five high-severity CVEs. Although the requested headline refers to seven vulnerabilities and path traversal, the supplied details do not establish either claim.

Key details

• Progress released a November 2026 service pack fixing five high-severity CVEs in WS_FTP Server.
• CVE-2026-115341 allows an authenticated FTP user to read files outside their intended scope via Thin Client Web Transfer.
• CVE-2026-115339 enables unauthenticated remote memory exhaustion of the XFT service due to insufficient resource limits.
• CVE-2026-35189 triggers excessive memory use and denial of service via OpenSSL certificate revocation list processing.
• Progress recommends upgrading to WS_FTP Server 2025.0.5 (version 10.0.5) to resolve all listed vulnerabilities.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.