Progress WS_FTP Server patches five flaws in 2025.0.5 and 2024.0.8, including an OpenSSL memory-drain bug
Progress Software released its November 2026 update for Progress WS_FTP Server to fix five flaws that the article describes as high-risk: the badge counts four High and one Medium. The bugs can expose files and credentials, let a network attacker snoop on or alter XFT traffic, and crash or exhaust memory in services. CVE-2026-115338 carries the highest score cited, 8.1 under CVSS v3. The article reports no confirmed exploitation in the wild and no public exploit code. Prerequisites limit exposure: the XFT transport flaw needs plain HTTP enabled, the file-read flaw needs a logged-in FTP user, and the OpenSSL flaw needs client-certificate requests enabled. The Progress advisory was not opened during this analysis, so the versions and scores below come from the article alone.
Entenda a falha
A vulnerabilidade
Progress WS_FTP Server for Windows has five flaws. CVE-2026-115338 (CVSS 8.1): when the XFT service allows plain HTTP, a network attacker can read private data or alter XFT requests. CVE-2026-115341 (7.7): weak access rules in Thin Client Web Transfer let a logged-in FTP user read files outside their allowed folder. CVE-2026-115339 (7.5) lets a remote attacker drain memory and crash XFT, and CVE-2026-35189 (7.5, CWE-770) is an OpenSSL flaw where crafted client certificates drain heap memory during TLS handshakes. CVE-2026-115340 (7.1) may leave credentials and session data in a temporary file. All are fixed in 2025.0.5 (10.0.5); the OpenSSL flaw also affects builds before 2024.0.8 (9.0.8) that request client certificates. The article's badge (4 High, 1 Medium) does not match its CVSS scores, which are all High.
Como funciona
For the XFT transport flaw, a client connects to the XFT service over plain HTTP, which the server accepts when that option is enabled. Because the traffic is not protected, someone on the network path can read it or change requests in transit. For the file-read flaw, an authenticated FTP user uses Thin Client Web Transfer, and the server's access rules do not keep requests inside the user's permitted folder. In the memory flaws, XFT requests or crafted client certificates in a TLS handshake make the server consume memory it does not release, until the service degrades or crashes. In the credentials flaw, a web file transfer makes the server write credentials and session data to a temporary file.
Por que é vulnerável
The articles give only the broad causes. The XFT flaw depends on a configuration that permits unencrypted HTTP, and the file-read flaw comes from weak access rules in Thin Client Web Transfer. The OpenSSL bug is classified as CWE-770, allocation of resources without limits, so crafted certificates can exhaust heap memory. The temporary-file flaw is sensitive data being written to disk during web transfers. The fix is WS_FTP Server 2025.0.5, which also updates OpenSSL to 3.5.9; 2024.0.8 carries the same OpenSSL update. The articles do not detail the code-level changes.
Como foi descoberta
Progress Software disclosed the flaws in its November 2026 update and advisory. Researchers Momen Elmady of Oxmatrix and Mateusz Mieczkowski of rexnets reported two of the issues; the article does not say which. It does not say how the others were found. No active exploitation and no public exploit code were reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 02:18.
Detalhes técnicos
- CVE-2026-115338 (CVSS 8.1): the XFT service, when plain HTTP connections are allowed, lets a network attacker read private data or alter XFT requests.
- CVE-2026-115341 (CVSS 7.7): weak access rules in Thin Client Web Transfer let a logged-in FTP user read files outside their permitted folder scope.
- CVE-2026-115339 (CVSS 7.5): a remote attacker can drain server memory and crash the XFT service.
- CVE-2026-115340 (CVSS 7.1): during web file transfers, the server may write sensitive user credentials and session data to a temporary file, where access could expose them.
- CVE-2026-35189 (CVSS 7.5, CWE-770): an OpenSSL flaw in which crafted client certificates drain heap memory during TLS handshakes.
All five affect Windows builds before 2025.0.5 (10.0.5). The OpenSSL flaw also affects builds before 2024.0.8 (9.0.8) that request client certificates. The article's badge (4 High, 1 Medium) does not match its own CVSS figures, which all fall in the High band under CVSS v3; the vendor's ratings should be checked.
Remediação
- Upgrade to WS_FTP Server 2025.0.5, which fixes all five flaws and carries OpenSSL 3.5.9; the 2024.0.8 branch carries the OpenSSL update. The vendor warns that the upgrade causes an outage while it runs.
- If patching is not possible now, block HTTP on XFT, limit Web Transfer to trusted hosts, and turn off client-certificate requests.
Linha do tempo
-
Progress WS_FTP Server patches five flaws in 2025.0.5 and 2024.0.8, including an OpenSSL memory-drain bug
ler a análise desta fonte ocultar
Progress Software released its November 2026 update for Progress WS_FTP Server to fix five flaws that the article describes as high-risk: the badge counts four High and one Medium. The bugs can expose files and credentials, let a network attacker snoop on or alter XFT traffic, and crash or exhaust memory in services. CVE-2026-115338 carries the highest score cited, 8.1 under CVSS v3. The article reports no confirmed exploitation in the wild and no public exploit code. Prerequisites limit exposure: the XFT transport flaw needs plain HTTP enabled, the file-read flaw needs a logged-in FTP user, and the OpenSSL flaw needs client-certificate requests enabled. The Progress advisory was not opened during this analysis, so the versions and scores below come from the article alone.
Technical Details
- CVE-2026-115338 (CVSS 8.1): the XFT service, when plain HTTP connections are allowed, lets a network attacker read private data or alter XFT requests.
- CVE-2026-115341 (CVSS 7.7): weak access rules in Thin Client Web Transfer let a logged-in FTP user read files outside their permitted folder scope.
- CVE-2026-115339 (CVSS 7.5): a remote attacker can drain server memory and crash the XFT service.
- CVE-2026-115340 (CVSS 7.1): during web file transfers, the server may write sensitive user credentials and session data to a temporary file, where access could expose them.
- CVE-2026-35189 (CVSS 7.5, CWE-770): an OpenSSL flaw in which crafted client certificates drain heap memory during TLS handshakes.
All five affect Windows builds before 2025.0.5 (10.0.5). The OpenSSL flaw also affects builds before 2024.0.8 (9.0.8) that request client certificates. The article's badge (4 High, 1 Medium) does not match its own CVSS figures, which all fall in the High band under CVSS v3; the vendor's ratings should be checked.
Remediation
- Upgrade to WS_FTP Server 2025.0.5, which fixes all five flaws and carries OpenSSL 3.5.9; the 2024.0.8 branch carries the OpenSSL update. The vendor warns that the upgrade causes an outage while it runs.
- If patching is not possible now, block HTTP on XFT, limit Web Transfer to trusted hosts, and turn off client-certificate requests.