CVE-2026-115338
Awaiting Analysis Awaiting Analysis - Queue

Insufficient TLS Protection in WS_FTP Server

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Progress Software Corporation

Description
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-115338
EUVD
EUVD-2026-120109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software WS_FTP Server From 0 (inc) to 2025.0.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves insufficient protection of communications in Progress WS_FTP Server versions before 2025.0.5. When unencrypted connections are used, a network attacker could intercept sensitive information or modify requests.

Detection Guidance

Detect unencrypted WS_FTP Server connections by monitoring network traffic for plaintext FTP (port 21) or HTTP (port 80) traffic. Use tools like Wireshark to inspect packets for sensitive data transmission without encryption. Check server logs for unencrypted sessions or misconfigured protocols.

Impact Analysis

An attacker could capture sensitive data like login credentials or files during transfer. They might also alter requests to inject malicious content or redirect users to harmful sites.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for secure data transmission. Non-compliance may result in legal penalties.

Mitigation Strategies

Upgrade WS_FTP Server to version 2025.0.5 or later. Disable unencrypted FTP/HTTP connections and enforce TLS/SSL for all communications. Review and update firewall rules to block unencrypted traffic. Monitor for suspicious network activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...