CVE-2026-115340
Awaiting Analysis Awaiting Analysis - Queue

WS_FTP Server Credential Exposure in Windows

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: Progress Software Corporation

Description
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-115340
EUVD
EUVD-2026-120114

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software WS_FTP Server From 0 (inc) to 2025.0.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Progress Software WS_FTP Server versions before 2025.0.5 on Windows may write sensitive user credentials and session data to a temporary file during file transfer operations. This could expose confidential information if the temporary file is accessed improperly.

Impact Analysis

An attacker with local access could exploit this to steal credentials or session data, leading to unauthorized access to sensitive files or systems. The CVSS score of 7.1 indicates a high impact on confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade WS_FTP Server to version 2025.0.5 or later to address the credential and session data exposure issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115340. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...