{"id":67958,"date":"2026-10-31T07:36:07","date_gmt":"2026-10-31T14:36:07","guid":{"rendered":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/"},"modified":"2026-10-31T07:36:07","modified_gmt":"2026-10-31T14:36:07","slug":"cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per","status":"publish","type":"post","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/","title":{"rendered":"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection"},"content":{"rendered":"<p>CVE-2026-84295 is a CVSS 10.0 Progress WS_FTP Server vulnerability, an improper authentication flaw that lets an unauthenticated attacker read sensitive information from the server, including administrative credentials. Progress published it on 29 October 2026 with fourteen other WS_FTP Server CVEs, two of them OS command injection flaws. Nothing in the batch is known to be exploited, there is no public proof of concept, and CISA&#8217;s assessment reads &#8220;exploitation: none, automatable: yes, technical impact: total.&#8221; The reason to move anyway is precedent. The last pre-auth WS_FTP vulnerability rated 10.0, CVE-2023-40044, reached CISA&#8217;s Known Exploited Vulnerabilities catalog eight days after disclosure, and KEV marks it as used in ransomware campaigns. WS_FTP comes from the same vendor as MOVEit Transfer.<\/p>\n<p>Most coverage misses that there are two fix versions, not one. 2024.0.6 and 2025.0.3 fix CVE-2026-84295, but twelve other CVEs need 2024.0.7 and 2025.0.4, so a patch dashboard keyed to the headline CVE marks a server green while five paths to command execution stay open. Both fixes also shipped weeks before disclosure, under release notes that mention a PostgreSQL update and nothing else. This post is three things: a plain-English account of the whole batch from Progress&#8217;s own records, passive Nuclei templates that read the version WS_FTP announces before login and report the two fix trains separately, and a way to find every WS_FTP server on your attack surface, including the <code>sftp.<\/code> host someone stood up for one partner years ago. CVE-2026-84295 was reported by Luu Tien Thanh (thalu93). The rest of the batch is credited to Niv Levy, Tanishq Shah, Mieczkowski Mateusz (rexnets), Yash Kumar Kumawat (ykk0x) and Momen Elmady (0xmatrix).<\/p>\n<h2 id=\"cve-2026-84295-at-a-glance\">CVE-2026-84295 at a glance<\/h2>\n<ul>\n<li><strong>CVE-2026-84295<\/strong>, &#8220;Improper Authentication in Progress WS_FTP Server&#8221;. CWE-287 (improper authentication) and CWE-522 (insufficiently protected credentials).<\/li>\n<li><strong>Impact<\/strong>: an unauthenticated remote attacker can read sensitive information, including administrative credentials. Progress classifies the impact as an authentication bypass that &#8220;may enable further compromise&#8221; of the server.<\/li>\n<li><strong>CVSS 3.1<\/strong>: 10.0 Critical, <code>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H<\/code> (Progress as CNA). NVD status is &#8220;Awaiting Analysis&#8221;, with no NVD score of its own yet.<\/li>\n<li><strong>Affected<\/strong>: WS_FTP Server on Windows before 2024.0.6 and 2025.0.3. In internal version numbers, 9.0.x before 9.0.6, 10.0.x before 10.0.3, and every 8.x release, for which no fix exists.<\/li>\n<li><strong>Fixed<\/strong>: 2024.0.6 (9.0.6) and 2025.0.3 (10.0.3), released 3 September 2026.<\/li>\n<li><strong>Not enough on its own<\/strong>: twelve more CVEs in the same bulletin, including CVE-2026-90868 (OS command injection, 9.9), are fixed only in 2024.0.7 (9.0.7) and 2025.0.4 (10.0.4), released 1 October 2026.<\/li>\n<li><strong>Exploitation status<\/strong>: none known as of 31 October 2026. Not in CISA KEV. No public PoC or technical write-up. EPSS 0.55% (FIRST, 30 October).<\/li>\n<li><strong>Fix now<\/strong>: upgrade to 2025.0.4 or 2024.0.7, then rotate every WS_FTP administrator password.<\/li>\n<\/ul>\n<h2 id=\"what-is-cve-2026-84295\">What is CVE-2026-84295?<\/h2>\n<p>WS_FTP Server is Progress&#8217;s Windows managed file transfer server. It speaks FTP, FTPS and SFTP, and can add two web modules: the Web Transfer Module for browser access to folders, and Ad Hoc Transfer for person-to-person sends. Administrators use WS_FTP Server Manager, a web console hosted in IIS. It is usually deployed where files cross a trust boundary, such as payroll exports, partner drops and regulated data exchanges, which is what makes its administrative credentials valuable.<\/p>\n<p>Progress&#8217;s description is one sentence: improper authentication &#8220;could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.&#8221; The weakness IDs fill in the outline. CWE-287 says a request that should require authentication does not get it, and CWE-522 says what comes back includes credentials in a recoverable form. The scope change in the vector, <code>S:C<\/code>, is Progress saying the damage reaches beyond WS_FTP itself. Administrative access to a file transfer server is access to every file, account and folder mapping on it.<\/p>\n<p>Progress has not said which component is vulnerable, what the request looks like, or whether a module must be enabled. Most of the other fourteen records name a component (Ad Hoc Transfer, the Web Transfer Module, Manager, the SSH service); this one does not. There is no public bulletin either. Every record references a Salesforce Lightning link that redirects to a login page, so customers must find the article in the Progress Community portal, and everyone else has the CVE records and release notes.<\/p>\n<h3 id=\"a-quiet-fix-eight-weeks-early\">A quiet fix, eight weeks early<\/h3>\n<p>The fix for CVE-2026-84295 has been downloadable since 3 September 2026. The &#8220;Fixed Issues&#8221; page for 2025.0.3 lists eleven items, and its only security item reads: &#8220;The PostgreSQL version was updated to prevent a potential vulnerability.&#8221; The 2024.0.6 page lists four items, including the same line. Neither mentions authentication or credentials. The 2024.0.7 and 2025.0.4 notes are similar: an SFTP timeout fix, a memory-handling fix, and PostgreSQL and OpenSSL upgrades.<\/p>\n<table>\n<thead>\n<tr>\n<th>Date (2026)<\/th>\n<th>Event<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1 September<\/td>\n<td>CVE-2026-84294, 84295 and 84296 reserved<\/td>\n<\/tr>\n<tr>\n<td>3 September<\/td>\n<td>WS_FTP Server 2024.0.6 (9.0.6) and 2025.0.3 (10.0.3) released<\/td>\n<\/tr>\n<tr>\n<td>14 September<\/td>\n<td>CVE-2026-90861 through 90872 reserved<\/td>\n<\/tr>\n<tr>\n<td>1 October<\/td>\n<td>WS_FTP Server 2024.0.7 (9.0.7) and 2025.0.4 (10.0.4) released<\/td>\n<\/tr>\n<tr>\n<td>29 October<\/td>\n<td>All fifteen CVEs published between 15:42 and 15:57 UTC<\/td>\n<\/tr>\n<tr>\n<td>30 October<\/td>\n<td>CISA SSVC on CVE-2026-84295: exploitation none, automatable yes, technical impact total<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Fixing first and disclosing later gave customers a head start, but it has two costs. Anyone who read the September notes to judge urgency scheduled 2025.0.3 as routine maintenance. And the fixed binaries have been public for eight weeks, plenty of time to diff 9.0.5 against 9.0.6. We have no evidence anyone did, and would not assume nobody has.<\/p>\n<h2 id=\"two-fix-trains-all-15-ws_ftp-server-vulnerabilities-from-october-2026\">Two fix trains: all 15 WS_FTP Server vulnerabilities from October 2026<\/h2>\n<p>Here is every CVE Progress published on 29 October, sorted by fix train and then by score. Titles are Progress&#8217;s own.<\/p>\n<table>\n<thead>\n<tr>\n<th>CVE<\/th>\n<th>CVSS<\/th>\n<th>Progress title<\/th>\n<th>Privileges<\/th>\n<th>Fixed in<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>CVE-2026-84295<\/strong><\/td>\n<td><strong>10.0<\/strong><\/td>\n<td>Improper Authentication in Progress WS_FTP Server<\/td>\n<td>None<\/td>\n<td>2024.0.6 \/ 2025.0.3<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-84294<\/td>\n<td>7.7<\/td>\n<td>Information Disclosure in Ad Hoc Transfer<\/td>\n<td>Low<\/td>\n<td>2024.0.6 \/ 2025.0.3<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-84296<\/td>\n<td>6.8<\/td>\n<td>SSH Multi-Factor Authentication Bypass<\/td>\n<td>Low<\/td>\n<td>2024.0.6 \/ 2025.0.3<\/td>\n<\/tr>\n<tr>\n<td><strong>CVE-2026-90868<\/strong><\/td>\n<td><strong>9.9<\/strong><\/td>\n<td>OS Command Injection in Progress WS_FTP Server<\/td>\n<td>Low<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90863<\/td>\n<td>9.1<\/td>\n<td>Privilege Escalation via Missing Authorization in WS_FTP Manager<\/td>\n<td>High<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90864<\/td>\n<td>9.1<\/td>\n<td>Host Administrator Path Containment Bypass<\/td>\n<td>High<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90866<\/td>\n<td>9.1<\/td>\n<td>Virtual Folder Path Confinement Bypass<\/td>\n<td>High<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td><strong>CVE-2026-90865<\/strong><\/td>\n<td><strong>9.0<\/strong><\/td>\n<td>Command Injection via FTP Notification Variables<\/td>\n<td>None (AC:H)<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90867<\/td>\n<td>8.1<\/td>\n<td>Improper Access Control of Web Admin Console<\/td>\n<td>None (AC:H)<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90869<\/td>\n<td>7.5<\/td>\n<td>Pre-Authentication SSH Denial of Service<\/td>\n<td>None<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90861<\/td>\n<td>6.6<\/td>\n<td>Password Disclosure via Activity Logs<\/td>\n<td>High<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90872<\/td>\n<td>6.6<\/td>\n<td>Server-Side Script Injection in Manager Web UI<\/td>\n<td>High<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90870<\/td>\n<td>5.3<\/td>\n<td>Unauthenticated Ad Hoc Transfer Resource Exhaustion<\/td>\n<td>None<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90871<\/td>\n<td>5.3<\/td>\n<td>Path Traversal Leading to File Deletion in AHT and WTM<\/td>\n<td>None<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<tr>\n<td>CVE-2026-90862<\/td>\n<td>4.3<\/td>\n<td>Web Transfer Module MFA Bypass<\/td>\n<td>None (UI:R)<\/td>\n<td>2024.0.7 \/ 2025.0.4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Five rows in the second train end in command execution. CVE-2026-90868, the highest score in the batch, lets a low-privileged user inject &#8220;shell operators and execution of arbitrary commands&#8221; under &#8220;certain configurations.&#8221; CVE-2026-90865 needs no account, runs as LocalSystem, and its title names the mechanism: FTP notification variables. The &#8220;certain configurations&#8221; are presumably notification rules that use those variables; Progress has not said, so review yours. CVE-2026-90863, 90866 and 90872 each turn an administrative role into command execution on the host. That is where CVE-2026-84295 comes back in.<\/p>\n<p>The trap is in how tools roll these records up. CVE-2026-84295&#8217;s record is correct that 2024.0.6 fixes it, so a scanner, CMDB or compliance report tracking the headline CVE will close the ticket on 9.0.6. Close it only on 9.0.7 or 10.0.4.<\/p>\n<h2 id=\"affected-and-fixed-ws_ftp-server-versions\">Affected and fixed WS_FTP Server versions<\/h2>\n<p>WS_FTP versions have two numbering schemes. The product name uses the year (2024.0.6), while the banner, the installer and most support articles use the internal version (9.0.6). Use the internal number when you read a scan result.<\/p>\n<table>\n<thead>\n<tr>\n<th>Product line<\/th>\n<th>Internal version<\/th>\n<th>Fixes CVE-2026-84295<\/th>\n<th>Fixes all 15 CVEs<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>WS_FTP Server 2025.0<\/td>\n<td>10.0.x<\/td>\n<td>2025.0.3 (10.0.3)<\/td>\n<td><strong>2025.0.4 (10.0.4)<\/strong><\/td>\n<\/tr>\n<tr>\n<td>WS_FTP Server 2024.0<\/td>\n<td>9.0.x<\/td>\n<td>2024.0.6 (9.0.6)<\/td>\n<td><strong>2024.0.7 (9.0.7)<\/strong><\/td>\n<\/tr>\n<tr>\n<td>WS_FTP Server 2022.0<\/td>\n<td>8.8.x<\/td>\n<td>No fix<\/td>\n<td>No fix: upgrade to 2025.0<\/td>\n<\/tr>\n<tr>\n<td>WS_FTP Server 2020.0 and older<\/td>\n<td>8.7.x and below<\/td>\n<td>No fix<\/td>\n<td>No fix: upgrade to 2025.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Progress&#8217;s CVE ranges start at version 0, so every 8.x release is in scope, and no 8.x fix has been published. Progress&#8217;s support guidance treats 8.7 and 8.8 as Sunset and recommends running 9.0 or 10.0 only. The 2025 upgrade documentation supports a direct upgrade from 2020 (8.7) or newer.<\/p>\n<h3 id=\"ws_ftp-server-latest-version-and-release-history\">WS_FTP Server latest version and release history<\/h3>\n<p>As of 31 October 2026, the latest Progress WS_FTP Server releases are <strong>2025.0.4 (10.0.4)<\/strong> and <strong>2024.0.7 (9.0.7)<\/strong>, both released on 1 October 2026. Here is the full release history for the two supported lines, from Progress&#8217;s release notes. Every build above the bold row on each line is affected by at least part of the October batch.<\/p>\n<table>\n<thead>\n<tr>\n<th>WS_FTP Server 2025<\/th>\n<th>Internal<\/th>\n<th>Released<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>2025.0<\/td>\n<td>10.0<\/td>\n<td>10 December 2025<\/td>\n<\/tr>\n<tr>\n<td>2025.0.1<\/td>\n<td>10.0.1<\/td>\n<td>28 January 2026<\/td>\n<\/tr>\n<tr>\n<td>2025.0.2<\/td>\n<td>10.0.2<\/td>\n<td>25 March 2026<\/td>\n<\/tr>\n<tr>\n<td>2025.0.3<\/td>\n<td>10.0.3<\/td>\n<td>3 September 2026<\/td>\n<\/tr>\n<tr>\n<td><strong>2025.0.4<\/strong><\/td>\n<td><strong>10.0.4<\/strong><\/td>\n<td><strong>1 October 2026<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<table>\n<thead>\n<tr>\n<th>WS_FTP Server 2024<\/th>\n<th>Internal<\/th>\n<th>Released<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>2024.0<\/td>\n<td>9.0<\/td>\n<td>23 October 2024<\/td>\n<\/tr>\n<tr>\n<td>2024.0.1<\/td>\n<td>9.0.1<\/td>\n<td>5 March 2025<\/td>\n<\/tr>\n<tr>\n<td>2024.0.2<\/td>\n<td>9.0.2<\/td>\n<td>6 August 2025<\/td>\n<\/tr>\n<tr>\n<td>2024.0.3<\/td>\n<td>9.0.3<\/td>\n<td>28 August 2025<\/td>\n<\/tr>\n<tr>\n<td>2024.0.4<\/td>\n<td>9.0.4<\/td>\n<td>28 January 2026<\/td>\n<\/tr>\n<tr>\n<td>2024.0.5<\/td>\n<td>9.0.5<\/td>\n<td>25 March 2026<\/td>\n<\/tr>\n<tr>\n<td>2024.0.6<\/td>\n<td>9.0.6<\/td>\n<td>3 September 2026<\/td>\n<\/tr>\n<tr>\n<td><strong>2024.0.7<\/strong><\/td>\n<td><strong>9.0.7<\/strong><\/td>\n<td><strong>1 October 2026<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Two upgrade notes from Progress&#8217;s documentation can save an outage. The installer uses PowerShell scripts to set encryption settings in the registry, and if script execution is blocked, services may not start afterwards. And upgrading to 2025 requires FTPS RSA certificates of at least 2048 bits. An approved change ticket is not an installed build, so check the version on the box afterwards.<\/p>\n<h2 id=\"how-the-attack-chain-works\">How the attack chain works<\/h2>\n<p>Progress has not published the vulnerable request and we have not reproduced the bug, so there is no request skeleton here; anything we drew would be invented. What the published records add up to is uncomfortable enough.<\/p>\n<ol>\n<li><strong>Step one is vendor-stated.<\/strong> CVE-2026-84295 gives an unauthenticated attacker administrative credentials.<\/li>\n<li><strong>Step two is arithmetic.<\/strong> Every host below 9.0.6 or 10.0.3 is also below 9.0.7 or 10.0.4. So every server exposed to CVE-2026-84295 is also exposed to the second train. That train includes CVE-2026-90863 (a delegated Host Administrator escalates to &#8220;arbitrary command execution with elevated privileges&#8221;), CVE-2026-90866 (a Host Administrator escapes the host root and reaches remote code execution) and CVE-2026-90872 (a Manager administrator runs &#8220;arbitrary JScript and OS commands in the IIS worker process&#8221;).<\/li>\n<li><strong>Step three is our inference, not Progress&#8217;s statement.<\/strong> The administrative credentials from step one are the privileges that step two requires.<\/li>\n<\/ol>\n<p>Put together, the realistic worst case for a server on 9.0.5 or 10.0.2 is unauthenticated to OS command execution in two steps, with no user interaction. Progress has not described this chain, and we may be wrong about which credentials leak. It is still the case to defend against, and why the advice is 9.0.7 or 10.0.4 rather than the minimum fix.<\/p>\n<p>There is no public CVE-2026-84295 PoC, and we are deliberately not publishing a working exploit, or a guess at one. Everything below reads versions the server announces to every client before login. The same pattern, an authentication bypass where patching closes the hole but not what already leaked, came up in our <a href=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-82329-jfrog-artifactory-auth-bypass-detection-with-sn1per\/\">JFrog Artifactory CVE-2026-82329 advisory<\/a>: upgrading does not un-leak a password.<\/p>\n<h2 id=\"am-i-affected-quick-manual-checks\">Am I affected? Quick manual checks<\/h2>\n<p><strong>On the server (authoritative).<\/strong> Check the installed build in WS_FTP Server Manager, or query the Windows uninstall keys from PowerShell:<\/p>\n<pre><code class=\"language-powershell\">Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',\n                 'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' |\n  Where-Object { $_.DisplayName -like '*WS_FTP Server*' } |\n  Select-Object DisplayName, DisplayVersion, InstallDate\n<\/code><\/pre>\n<p>Anything below 9.0.7 or 10.0.4 is affected by at least part of the batch. Anything below 9.0.6 or 10.0.3 is affected by CVE-2026-84295 too. In a cluster, check every node, not just the one the load balancer showed you.<\/p>\n<h3 id=\"how-to-check-your-ws_ftp-server-version-remotely\">How to check your WS_FTP Server version remotely<\/h3>\n<p>WS_FTP announces its internal version before anyone logs in, on both the FTP and SSH listeners. Every FTP or SFTP client receives that greeting on connect, so reading it sends nothing:<\/p>\n<pre><code class=\"language-bash\"># FTP greeting on 21 (read-only)\ntimeout 5 nc ftp.example.com 21 &lt;\/dev\/null\n# 220 ftp.example.com X2 WS_FTP Server 9.0.5(48210169)\n\n# SSH identification string on 22 (SFTP)\ntimeout 5 nc sftp.example.com 22 &lt;\/dev\/null\n# SSH-2.0-WS_FTP-SSH_10.0.4\n\n# Or let nmap parse both\nnmap -sV -Pn -p 21,22 ftp.example.com\n# 21\/tcp open  ftp  WS FTPd 9.0.5(48210169)\n# 22\/tcp open  ssh  WS_FTP sshd 10.0.4 (protocol 2.0)\n<\/code><\/pre>\n<p>The first example, 9.0.5, is affected by all fifteen CVEs; the second, 10.0.4, is fully patched. The number in parentheses varies between servers on the same release, so ignore it. Public search data shows real 9.0.0 through 9.0.3 servers announcing themselves in exactly this format.<\/p>\n<p>The external signal has limits. Administrators can hide the SSH version and customise the FTP greeting, and a hidden version means &#8220;unknown,&#8221; not &#8220;patched.&#8221; Many deployments also firewall 21 and 22 and expose only HTTPS for the web modules. For those, the Ad Hoc Transfer bundle carries a build date:<\/p>\n<pre><code class=\"language-bash\">curl -sk https:\/\/files.example.com\/AHT\/AHT_UI\/public\/js\/app.min.js | head -c 120\n# \/*! fileTransfer 15-03-2026 *\/\n<\/code><\/pre>\n<p>The date is day-month-year. A bundle built on 15 March 2026 predates both 2026 fix trains, provided Progress rebuilds the bundle for each release, which is an assumption. Treat it as a lead and confirm with the banner or on the server.<\/p>\n<h2 id=\"nuclei-detection-template-for-cve-2026-84295\">Nuclei detection template for CVE-2026-84295<\/h2>\n<p>There are three templates, all passive. <code>CVE-2026-84295.yaml<\/code> and <code>CVE-2026-90868.yaml<\/code> read the FTP and SSH greetings and gate on the two fix trains, so a server on exactly 9.0.6 or 10.0.3 shows up under the second template only. <code>wsftp-aht-build-predates-2026-fixes.yaml<\/code> covers HTTPS-only hosts through the Ad Hoc Transfer build date. None of them touches an authentication path to detect CVE-2026-84295 exposure.<\/p>\n<pre><code class=\"language-yaml\">id: CVE-2026-84295\n\ninfo:\n  name: Progress WS_FTP Server - Pre-Auth Improper Authentication \/ Admin Credential Disclosure (CVE-2026-84295)\n  author: xer0dayz\n  severity: critical\n  description: |\n    Improper authentication in Progress WS_FTP Server on Windows before 2024.0.6 (9.0.6) and\n    2025.0.3 (10.0.3) lets an unauthenticated remote attacker read sensitive information,\n    including administrative credentials (CWE-287, CWE-522). Progress rates it CVSS 10.0 and\n    has not published the vulnerable component or request path. The same fix train also\n    closes CVE-2026-84294 (Ad Hoc Transfer path traversal) and CVE-2026-84296 (SSH MFA bypass).\n\n    This template is NON-DESTRUCTIVE: it opens a TCP connection to the FTP (21) and SSH (22)\n    listeners, reads the greeting the server sends to every client before login, extracts the\n    internal WS_FTP version from &quot;X2 WS_FTP Server &lt;ver&gt;&quot; or &quot;SSH-2.0-WS_FTP-SSH_&lt;ver&gt;&quot;, and\n    flags builds below the fix. It sends no credentials, no FTP commands and no exploit\n    payload, and it never touches an authentication path.\n\n    WS_FTP banners carry the INTERNAL version: 2024.0.x = 9.0.x, 2025.0.x = 10.0.x,\n    2022.0.x = 8.8.x. A 9.0.6 or 10.0.3 host is fixed for this CVE but still exposed to the\n    twelve CVEs fixed one release later - run CVE-2026-90868.yaml alongside this template.\n\n    Blind spots: a customised or suppressed banner produces no result, which means UNKNOWN,\n    not patched. A banner reports the installed service build; confirm the build in WS_FTP\n    Server Manager or on the host before closing a finding. A target given with an explicit\n    port (host:2121, https:\/\/host:443) is probed on that port only.\n  remediation: |\n    Upgrade to WS_FTP Server 2025.0.4 (10.0.4) or 2024.0.7 (9.0.7), released 2026-10-01.\n    2025.0.3 \/ 2024.0.6 (released 2026-09-03) fix this CVE but leave CVE-2026-90861 through\n    CVE-2026-90872 open, including the CVE-2026-90868 and CVE-2026-90865 OS command\n    injection flaws. WS_FTP 2022.0 (8.8.x) and older receive no fix; upgrade to 2025.0 (10.0),\n    which supports a direct upgrade from 2020 (8.7) or newer.\n    Because the flaw discloses administrative credentials, treat every WS_FTP administrator\n    password (including delegated Host Administrators and Manager accounts) as exposed on any\n    host that was internet-reachable while unpatched: rotate them after upgrading and review\n    Manager and audit logs for unexpected admin sign-ins.\n  reference:\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-84295\n    - https:\/\/www.cve.org\/CVERecord?id=CVE-2026-84295\n    - https:\/\/docs.progress.com\/bundle\/wsftp-server-release-notes-2025\/page\/Whats-New-in-WS_FTP-Server-2025.html\n    - https:\/\/docs.progress.com\/bundle\/wsftp-server-release-notes-2024\/page\/Whats-New-in-WS_FTP-Server-2024.html\n  classification:\n    cvss-metrics: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-84295\n    cwe-id: CWE-287,CWE-522\n    cpe: cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: progress\n    product: ws_ftp_server\n    shodan-query:\n      - '&quot;X2 WS_FTP Server&quot;'\n      - '&quot;WS_FTP-SSH&quot;'\n  tags: cve,cve2026,ws_ftp,wsftp,progress,auth-bypass,network,tcp,passive\n\ntcp:\n  - host:\n      - &quot;{{Hostname}}&quot;\n    port: 21,22\n    read-size: 2048\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: wsftp-2025-10.0-below-10.0.3\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&gt;= 10.0.0', '&lt; 10.0.3')&quot;\n\n      - type: dsl\n        name: wsftp-2024-9.0-below-9.0.6\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&gt;= 9.0.0', '&lt; 9.0.6')&quot;\n\n      - type: dsl\n        name: wsftp-8.x-or-older-sunset-no-fix\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&lt; 9.0.0')&quot;\n\n    extractors:\n      - type: regex\n        name: wsftp_version\n        internal: true\n        group: 1\n        regex:\n          - '(?m)^(?:220[ -].*?X2 WS_FTP Server |SSH-[0-9.]+-WS_FTP-SSH_)([0-9]+\\.[0-9]+(?:\\.[0-9]+)*)'\n\n      - type: regex\n        name: banner\n        group: 1\n        regex:\n          - '(?m)^(220[ -].*?X2 WS_FTP Server [0-9][^\\r\\n]*|SSH-[0-9.]+-WS_FTP-SSH_[^\\r\\n]*)'\n<\/code><\/pre>\n<p>The companion template for the second train, <code>CVE-2026-90868.yaml<\/code>, is identical apart from its metadata and these three gates:<\/p>\n<pre><code class=\"language-yaml\">      - type: dsl\n        name: wsftp-2025-10.0-below-10.0.4\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&gt;= 10.0.0', '&lt; 10.0.4')&quot;\n\n      - type: dsl\n        name: wsftp-2024-9.0-below-9.0.7\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&gt;= 9.0.0', '&lt; 9.0.7')&quot;\n\n      - type: dsl\n        name: wsftp-8.x-or-older-sunset-no-fix\n        dsl:\n          - &quot;compare_versions(wsftp_version, '&lt; 9.0.0')&quot;\n<\/code><\/pre>\n<p>The HTTPS-only lead template reads the Ad Hoc Transfer build banner:<\/p>\n<pre><code class=\"language-yaml\">id: wsftp-aht-build-predates-2026-fixes\n\ninfo:\n  name: Progress WS_FTP Server Ad Hoc Transfer - Build Predates September 2026 Fixes (CVE-2026-84295 Lead)\n  author: xer0dayz\n  severity: high\n  description: |\n    HTTP-only corroborating signal for Progress WS_FTP Server hosts that expose the Ad Hoc\n    Transfer (AHT) module over HTTPS but firewall FTP (21) and SSH (22), so the banner\n    templates CVE-2026-84295.yaml and CVE-2026-90868.yaml cannot read a version.\n\n    The AHT single-page app ships a minified bundle whose first line is a Grunt build banner,\n    &quot;\/*! fileTransfer DD-MM-YYYY *\/&quot;. The official CVE-2023-40044 template uses the same file\n    and banner to separate pre-fix and post-fix builds. This template flags a bundle built\n    before 2026-08-01. The first fix train (2024.0.6 \/ 2025.0.3, closing CVE-2026-84295)\n    shipped 2026-09-03, so a bundle that old points to an install that predates both 2026 fix\n    trains and all fifteen CVEs published 2026-10-29.\n\n    This is a LEAD, not a version: it assumes the AHT bundle is rebuilt for each release.\n    Confirm with the banner templates or WS_FTP Server Manager before filing. A bundle dated\n    August 2026 or later produces no result (inconclusive), and a host without the AHT module\n    returns 404 (no result).\n\n    NON-DESTRUCTIVE: one anonymous GET for a static JavaScript file. No authentication path,\n    no AHT API call, no payload.\n  remediation: |\n    Confirm the installed build, then upgrade to WS_FTP Server 2025.0.4 (10.0.4) or 2024.0.7\n    (9.0.7). If AHT is not needed, disable it (Progress's workaround for CVE-2026-84294) or\n    restrict it to trusted networks. Rotate WS_FTP administrator passwords after upgrading\n    any host that was internet-reachable while unpatched (CVE-2026-84295 discloses\n    administrative credentials).\n  reference:\n    - https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-84295\n    - https:\/\/www.cve.org\/CVERecord?id=CVE-2026-84294\n    - https:\/\/github.com\/projectdiscovery\/nuclei-templates\/blob\/main\/http\/cves\/2023\/CVE-2023-40044.yaml\n    - https:\/\/docs.progress.com\/bundle\/wsftp-server-release-notes-2025\/page\/Whats-New-in-WS_FTP-Server-2025.html\n  classification:\n    cvss-metrics: CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-84295\n    cwe-id: CWE-287,CWE-522\n    cpe: cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: progress\n    product: ws_ftp_server\n    shodan-query: http.title:&quot;Ad Hoc Transfer&quot;\n  tags: cve,cve2026,ws_ftp,wsftp,progress,ad-hoc-transfer,passive\n\nhttp:\n  - method: GET\n    path:\n      - &quot;{{BaseURL}}\/AHT\/AHT_UI\/public\/js\/app.min.js&quot;\n\n    max-size: 4096\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: regex\n        name: aht-build-before-2026-08\n        part: body\n        regex:\n          - '\/\\*! fileTransfer [0-9]{1,2}-(0[1-9]|1[0-2])-(19[0-9]{2}|20[01][0-9]|202[0-5]) \\*\/'\n          - '\/\\*! fileTransfer [0-9]{1,2}-0[1-7]-2026 \\*\/'\n        condition: or\n\n    extractors:\n      - type: regex\n        name: aht_build_date\n        part: body\n        group: 1\n        regex:\n          - '\/\\*! fileTransfer ([0-9]{1,2}-[0-9]{2}-[0-9]{4}) \\*\/'\n<\/code><\/pre>\n<p>Save them and run against bare hostnames, so both 21 and 22 are probed:<\/p>\n<pre><code class=\"language-bash\">nuclei -t CVE-2026-84295.yaml -t CVE-2026-90868.yaml -l wsftp-hosts.txt\nnuclei -t wsftp-aht-build-predates-2026-fixes.yaml -l wsftp-https-urls.txt\n<\/code><\/pre>\n<p>A server on 9.0.5 produces two lines, and one on 10.0.3 produces one:<\/p>\n<pre><code>[CVE-2026-84295:wsftp-2024-9.0-below-9.0.6] [tcp] [critical] ftp.example.com:21 [&quot;220 ftp.example.com X2 WS_FTP Server 9.0.5(48210169)&quot;]\n[CVE-2026-90868:wsftp-2024-9.0-below-9.0.7] [tcp] [critical] ftp.example.com:21 [&quot;220 ftp.example.com X2 WS_FTP Server 9.0.5(48210169)&quot;]\n[CVE-2026-90868:wsftp-2025-10.0-below-10.0.4] [tcp] [critical] sftp.example.com:22 [&quot;SSH-2.0-WS_FTP-SSH_10.0.3&quot;]\n<\/code><\/pre>\n<h3 id=\"why-the-banner-and-not-the-javascript-build-date\">Why the banner and not the JavaScript build date<\/h3>\n<p>The official template for the 2023 WS_FTP bug matches the Ad Hoc Transfer build banner, and we reuse that approach for HTTPS-only hosts. But the banner is a Grunt build stamp in day-month-year order that records when the web bundle was built, not which release is installed, so mapping it to 9.0.6 or 9.0.7 means guessing. The FTP and SSH greetings carry the exact internal version, which makes the gate plain arithmetic. So the banner is the primary check and the build date is the lead.<\/p>\n<h3 id=\"blind-spots-stated-plainly\">Blind spots, stated plainly<\/h3>\n<ul>\n<li><strong>Silence means unknown.<\/strong> A hidden SSH version, a customised FTP greeting or a firewalled port produces no result. None of those mean the server is patched.<\/li>\n<li><strong>A banner is the running service build.<\/strong> Confirm in WS_FTP Server Manager before you close a finding, and check every node in a cluster.<\/li>\n<li><strong>An input with a port probes only that port.<\/strong> <code>https:\/\/host:443<\/code> or <code>host:2121<\/code> overrides the template&#8217;s 21 and 22. Feed bare hostnames, or <code>host:port<\/code> for non-standard listeners.<\/li>\n<li><strong>Mocks, not a live install.<\/strong> We ran all three templates and the bundled checker through 99 boundary checks across 36 mock listeners: every release line, both fix boundaries, FIPS and multi-line greetings, a version-like hostname, hidden banners and non-WS_FTP servers. We confirmed that they write zero bytes to the socket. We have not run them against a real WS_FTP installation, so <code>verified<\/code> stays <code>false<\/code>.<\/li>\n<\/ul>\n<h2 id=\"detecting-cve-2026-84295-across-your-attack-surface-with-sn1per\">Detecting CVE-2026-84295 across your attack surface with Sn1per<\/h2>\n<p>The template is the easy half; the hard half is the host list. File transfer servers pile up quietly: the <code>sftp.<\/code> host built for one partner&#8217;s payroll feed, the <code>ftp.<\/code> box inherited in an acquisition, the <code>files.<\/code> portal a business unit bought on its own, the DR copy nobody upgraded. Those are the servers still on 8.8 in 2026, and they are rarely in the CMDB. Treat this as a discovery problem first.<\/p>\n<pre><code class=\"language-bash\"># 1. Discover: subdomains, certificate transparency, DNS\nsniper -t example.com -m recon -w wsftp-2026\n\n# 2. Service pass on candidate hosts: nmap -sV on 21 and 22 records the WS_FTP build\nsniper -t sftp.example.com -m normal -w wsftp-2026\n\n# 3. Read the build straight out of the loot\ngrep -hE &quot;WS FTPd|WS_FTP sshd&quot; \\\n  \/usr\/share\/sniper\/loot\/workspace\/wsftp-2026\/output\/nmap-*-port2[12].txt\n\n# 4. Run the banner templates across every hostname the workspace found\nnuclei -t CVE-2026-84295.yaml -t CVE-2026-90868.yaml \\\n  -l \/usr\/share\/sniper\/loot\/workspace\/wsftp-2026\/domains\/domains-all-sorted.txt\n<\/code><\/pre>\n<p>Drop all three templates into <code>\/sniper\/templates\/nuclei\/server\/<\/code>. The Ad Hoc Transfer template then runs on every HTTP and HTTPS port Sn1per finds, with no configuration change. The two banner templates need bare hostnames, and in a default configuration Sn1per hands the curated set <code>host:port<\/code> web targets. Either run step 4 above, or enable the all-subdomain vulnerability pass so recon mode feeds every resolvable host to the curated set:<\/p>\n<pre><code class=\"language-bash\">cp \/usr\/share\/sniper\/conf\/default ~\/wsftp-recon.conf\nsed -i 's\/^NUCLEI_ALL_SUBS_VULNERABILITY_SCAN=.*\/NUCLEI_ALL_SUBS_VULNERABILITY_SCAN=&quot;1&quot;\/' ~\/wsftp-recon.conf\nsniper -c ~\/wsftp-recon.conf -t example.com -m recon -w wsftp-2026\n<\/code><\/pre>\n<p>Then run the bundled detection-only checker over the same list. It reports both trains per host, adds the Ad Hoc Transfer lead with <code>--http<\/code>, and exits non-zero if anything is affected:<\/p>\n<pre><code class=\"language-bash\">.\/cve-2026-84295-detect.py --http -f wsftp-hosts.txt\n<\/code><\/pre>\n<p>Pull findings out of a Professional or Enterprise install over the API:<\/p>\n<pre><code class=\"language-bash\">curl -sk -H &quot;X-API-Key: $SN1PER_API_KEY&quot; \\\n  &quot;https:\/\/sn1per.local\/pro\/api.php?action=vulnerabilities&amp;workspace=wsftp-2026&quot; \\\n  | jq -r '.[] | select(.name | test(&quot;84295|90868|wsftp-aht&quot;)) | [.host, .severity, .details] | @tsv'\n<\/code><\/pre>\n<p>One note on where this runs. The output is a list of your file transfer servers, the build each runs, and which ones hand out admin credentials to strangers. That is a target list, and it should not be generated inside someone else&#8217;s multi-tenant cloud. Sn1per runs on your hardware and the findings stay there. The longer version of that argument is in our guide to <a href=\"https:\/\/sn1persecurity.com\/wordpress\/external-attack-surface-management-with-sn1per\/\">external attack surface management with Sn1per<\/a>.<\/p>\n<h2 id=\"which-sn1per-edition-fits\">Which Sn1per edition fits<\/h2>\n<table>\n<thead>\n<tr>\n<th>Capability<\/th>\n<th><a href=\"https:\/\/sn1persecurity.com\/wordpress\/sn1per-community-edition\/\">Community<\/a><\/th>\n<th><a href=\"https:\/\/sn1persecurity.com\/wordpress\/product\/sn1per-professional-2026-license\/\">Professional 2026<\/a><\/th>\n<th><a href=\"https:\/\/sn1persecurity.com\/wordpress\/product\/sn1per-enterprise\/\">Enterprise<\/a><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Run the WS_FTP templates<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>nmap -sV build capture on 21 and 22<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Curated Nuclei set maintained for you<\/td>\n<td>Partial<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Workspaces and scan history<\/td>\n<td>Basic<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Web UI with asset risk ranking<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>JSON API for finding export<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Scheduled recurring surface sweeps<\/td>\n<td>No<\/td>\n<td>Limited<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Multi-user, delegated workspaces<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>For a one-off answer, Community plus the templates is enough. The recurring question matters more: fifteen CVEs in one product on one day, fixed across two releases a month apart, and the next bulletin will move the fix line again. That is the case for <a href=\"https:\/\/sn1persecurity.com\/wordpress\/continuous-attack-surface-testing\/\">continuous attack surface testing<\/a> rather than a single sweep, and for folding the check into <a href=\"https:\/\/sn1persecurity.com\/wordpress\/automated-penetration-testing\/\">automated penetration testing<\/a> so a regression shows up the week it happens.<\/p>\n<h2 id=\"remediation-and-mitigation\">Remediation and mitigation<\/h2>\n<ol>\n<li><strong>Upgrade to WS_FTP Server 2025.0.4 (10.0.4) or 2024.0.7 (9.0.7).<\/strong> These are the only builds that close all fifteen CVEs. Do not stop at 2025.0.3 or 2024.0.6. Allow PowerShell script execution before running the installer, and check FTPS RSA certificates are at least 2048 bits before moving to 2025. Then confirm the version on every node.<\/li>\n<li><strong>If you are on 8.x, there is no patch.<\/strong> Plan the upgrade to 2025.0, which supports a direct upgrade from 2020 (8.7) or newer, and take the server off the internet until it is done.<\/li>\n<li><strong>Rotate administrator credentials after upgrading.<\/strong> That means system administrators, delegated Host Administrators and Manager accounts. Patching closes the hole but does not un-leak a password. If WS_FTP authenticates administrators against Windows or Active Directory, the exposed password may be a domain password, so rotate it there and check where else it works.<\/li>\n<li><strong>Restrict the WS_FTP Server Manager and Web Admin console to administrative networks.<\/strong> This is Progress&#8217;s own workaround for CVE-2026-90867 and CVE-2026-90872, and a reasonable permanent posture.<\/li>\n<li><strong>Review notification rules, delegated Host Administrators and virtual folder paths.<\/strong> These are the workarounds Progress lists for CVE-2026-90865, 90863, 90864 and 90866. Remove delegation that nobody needs, and confirm every virtual folder&#8217;s physical path stays inside its host root.<\/li>\n<li><strong>Turn off modules you do not use.<\/strong> Disable Ad Hoc Transfer if nobody sends ad hoc files (CVE-2026-84294, 90870, 90871). Disable the Web Transfer Module if users only connect with clients (CVE-2026-90862, 90871). Disable SSH if you only offer FTPS (CVE-2026-90869).<\/li>\n<li><strong>Enable MFA for Manager after upgrading.<\/strong> The 2025 line supports TOTP for Manager and Ad Hoc Transfer. With the two MFA-bypass CVEs fixed in the same releases, MFA makes a replayed administrator password far less useful.<\/li>\n<li><strong>Stop changing privileged passwords over FTP until you are upgraded.<\/strong> CVE-2026-90861 writes password-change arguments to logs that a delegated administrator can read.<\/li>\n<\/ol>\n<h2 id=\"if-you-were-exposed-hunting-for-credential-theft-and-follow-on-activity\">If you were exposed: hunting for credential theft and follow-on activity<\/h2>\n<p>No indicators of compromise have been published for this batch, and nobody has reported exploitation. If a server sat on the internet below 9.0.6 or 10.0.3, check these before you decide it was untouched:<\/p>\n<ul>\n<li><strong>Administrator sign-ins.<\/strong> Review WS_FTP Server Manager and IIS logs for administrative sessions from addresses you do not recognise, especially since 3 September, when the fixed build became available to diff.<\/li>\n<li><strong>Configuration drift.<\/strong> Look for new or changed administrators, Host Administrators, user accounts, SSH public keys, virtual folders, and notification rules or actions you did not create.<\/li>\n<li><strong>Process lineage.<\/strong> Look for <code>csc.exe<\/code>, <code>cmd.exe<\/code>, <code>powershell.exe<\/code>, <code>certutil.exe<\/code> or <code>regsvr32.exe<\/code> started by the IIS worker processes (<code>w3wp.exe<\/code>) that host Manager, the Web Transfer Module and Ad Hoc Transfer, or by the WS_FTP services themselves (CVE-2026-90865 executes as LocalSystem). That is how the 2023 Ad Hoc Transfer exploitation showed up: <a href=\"https:\/\/www.rapid7.com\/blog\/post\/2023\/09\/29\/etr-critical-vulnerabilities-in-ws-ftp-server\/\">Rapid7 observed<\/a> <code>w3wp.exe<\/code> running the <code>WSFTPSVR_WTM<\/code> application pool spawning <code>csc.exe<\/code> and <code>cmd.exe<\/code>, then PowerShell downloads and <code>regsvr32<\/code>. Application pool names may differ on 2024 and 2025 builds, so check yours in IIS Manager.<\/li>\n<li><strong>Files in web directories.<\/strong> Two of the path traversal CVEs carry CWE-434, unrestricted file upload. Look for new <code>.aspx<\/code>, <code>.ashx<\/code> or <code>.config<\/code> files and modified <code>web.config<\/code> files under the WS_FTP web application folders.<\/li>\n<li><strong>Outbound connections<\/strong> from the server to hosts that are not your partners, and unusual bulk downloads from user folders.<\/li>\n<\/ul>\n<p>If you find anything, preserve the disk and logs before rebuilding, then rotate every credential the server held, including partner accounts, SSH keys and the database account WS_FTP uses.<\/p>\n<h2 id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n<p><strong>Which WS_FTP Server version fixes CVE-2026-84295?<\/strong><br \/>\n2024.0.6 (9.0.6) and 2025.0.3 (10.0.3) fix CVE-2026-84295 itself, but twelve other CVEs from the same 29 October 2026 bulletin need 2024.0.7 (9.0.7) or 2025.0.4 (10.0.4), including the CVE-2026-90868 command injection. Upgrade to 2024.0.7 or 2025.0.4. WS_FTP 2022.0 (8.8.x) and older have no fix and must move to 2025.0. Because the flaw discloses administrative credentials, rotate every WS_FTP administrator password after upgrading.<\/p>\n<p><strong>Is WS_FTP Server CVE-2026-84295 being exploited?<\/strong><br \/>\nNot as of 31 October 2026. It is not in CISA&#8217;s KEV catalog, CISA&#8217;s SSVC assessment lists exploitation as none, and no public proof of concept or technical write-up exists. EPSS is 0.55%. Two facts argue against waiting. The fixed build has been public since 3 September, which leaves time to reverse the patch. And the previous pre-auth WS_FTP vulnerability rated 10.0, CVE-2023-40044, was added to KEV eight days after disclosure and is marked as used in ransomware campaigns.<\/p>\n<p><strong>How do I check my WS_FTP Server version remotely?<\/strong><br \/>\nRead the greeting WS_FTP sends before login. The FTP banner on port 21 reads &#8220;X2 WS_FTP Server 9.0.5(&#8230;)&#8221; and the SSH banner on port 22 reads &#8220;SSH-2.0-WS_FTP-SSH_10.0.4&#8221;. Both carry the internal version, where 9.0.x is the 2024 line and 10.0.x is the 2025 line. <code>nmap -sV -p 21,22<\/code> parses both. For HTTPS-only servers, the Ad Hoc Transfer file \/AHT\/AHT_UI\/public\/js\/app.min.js carries a build date that can point to an old install. A hidden banner means unknown, not patched.<\/p>\n<p><strong>Does CVE-2026-84295 affect the Ad Hoc Transfer or Web Transfer module?<\/strong><br \/>\nProgress has not named a component for CVE-2026-84295, so treat any WS_FTP Server below 9.0.6 or 10.0.3 as affected, whether or not those modules are installed. Four other CVEs in the batch do sit in the web modules. CVE-2026-84294 is a path traversal in Ad Hoc Transfer, CVE-2026-90870 is Ad Hoc Transfer resource exhaustion, CVE-2026-90871 is file deletion in both modules, and CVE-2026-90862 is an MFA bypass in the Web Transfer Module.<\/p>\n<p><strong>Is CVE-2026-84295 related to the 2023 WS_FTP Ad Hoc Transfer RCE (CVE-2023-40044)?<\/strong><br \/>\nNot technically. CVE-2023-40044 was a .NET deserialization flaw in the Ad Hoc Transfer module, fixed in 8.7.4 and 8.8.2, while CVE-2026-84295 is an authentication flaw with no named component. They share a product, a vendor and a severity rating. The 2023 bug&#8217;s history, in KEV within eight days and later used by ransomware operators, is why this one should be patched before it is exploited rather than after. Any server still on the 8.7 or 8.8 lines is exposed to all fifteen 2026 CVEs with no fix available.<\/p>\n<p><strong>Is the CVE-2026-84295 Nuclei template safe to run in production?<\/strong><br \/>\nYes. The two banner templates open a TCP connection to ports 21 and 22, read the greeting the server sends to every client, and close the connection. We confirmed that they write nothing to the socket, so there are no credentials, no commands and no login attempts. The Ad Hoc Transfer template sends one anonymous GET for a static JavaScript file. Treat a match as a strong lead to confirm on the server, and treat silence as unknown.<\/p>\n<h2 id=\"closing\">Closing<\/h2>\n<p>The lesson from CVE-2026-84295 is that you fix a CVE but you install a release. Progress&#8217;s records are accurate one CVE at a time, yet the release that closes the headline bug leaves twelve others open, five of them paths to command execution, and both fixes shipped under release notes that read like routine maintenance. Triage by CVE ID or by release notes alone gets this wrong in a way that looks right on a dashboard.<\/p>\n<p>The other lesson is older. File transfer servers sit on the edge, hold other people&#8217;s data, and get installed once and then forgotten. In 2023, MOVEit Transfer was mass-exploited as a zero-day, and the WS_FTP Ad Hoc Transfer bug was being exploited three days after disclosure.<\/p>\n<p>Grab the templates and run them across every hostname you own, not only the file transfer servers you know about. Upgrade to 2025.0.4 or 2024.0.7, rotate the administrator passwords, and lock the Manager console down to the people who actually use it.<\/p>\n<p><script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"FAQPage\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Which WS_FTP Server version fixes CVE-2026-84295?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"2024.0.6 (9.0.6) and 2025.0.3 (10.0.3) fix CVE-2026-84295 itself, but twelve other CVEs from the same 29 October 2026 bulletin need 2024.0.7 (9.0.7) or 2025.0.4 (10.0.4), including the CVE-2026-90868 command injection. Upgrade to 2024.0.7 or 2025.0.4. WS_FTP 2022.0 (8.8.x) and older have no fix and must move to 2025.0. Because the flaw discloses administrative credentials, rotate every WS_FTP administrator password after upgrading.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is WS_FTP Server CVE-2026-84295 being exploited?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Not as of 31 October 2026. It is not in CISA's KEV catalog, CISA's SSVC assessment lists exploitation as none, and no public proof of concept or technical write-up exists. EPSS is 0.55%. Two facts argue against waiting. The fixed build has been public since 3 September, which leaves time to reverse the patch. And the previous pre-auth WS_FTP vulnerability rated 10.0, CVE-2023-40044, was added to KEV eight days after disclosure and is marked as used in ransomware campaigns.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How do I check my WS_FTP Server version remotely?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Read the greeting WS_FTP sends before login. The FTP banner on port 21 reads \\\"X2 WS_FTP Server 9.0.5(...)\\\" and the SSH banner on port 22 reads \\\"SSH-2.0-WS_FTP-SSH_10.0.4\\\". Both carry the internal version, where 9.0.x is the 2024 line and 10.0.x is the 2025 line. nmap -sV -p 21,22 parses both. For HTTPS-only servers, the Ad Hoc Transfer file \/AHT\/AHT_UI\/public\/js\/app.min.js carries a build date that can point to an old install. A hidden banner means unknown, not patched.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Does CVE-2026-84295 affect the Ad Hoc Transfer or Web Transfer module?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Progress has not named a component for CVE-2026-84295, so treat any WS_FTP Server below 9.0.6 or 10.0.3 as affected, whether or not those modules are installed. Four other CVEs in the batch do sit in the web modules. CVE-2026-84294 is a path traversal in Ad Hoc Transfer, CVE-2026-90870 is Ad Hoc Transfer resource exhaustion, CVE-2026-90871 is file deletion in both modules, and CVE-2026-90862 is an MFA bypass in the Web Transfer Module.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is CVE-2026-84295 related to the 2023 WS_FTP Ad Hoc Transfer RCE (CVE-2023-40044)?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Not technically. CVE-2023-40044 was a .NET deserialization flaw in the Ad Hoc Transfer module, fixed in 8.7.4 and 8.8.2, while CVE-2026-84295 is an authentication flaw with no named component. They share a product, a vendor and a severity rating. The 2023 bug's history, in KEV within eight days and later used by ransomware operators, is why this one should be patched before it is exploited rather than after. Any server still on the 8.7 or 8.8 lines is exposed to all fifteen 2026 CVEs with no fix available.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is the CVE-2026-84295 Nuclei template safe to run in production?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Yes. The two banner templates open a TCP connection to ports 21 and 22, read the greeting the server sends to every client, and close the connection. We confirmed that they write nothing to the socket, so there are no credentials, no commands and no login attempts. The Ad Hoc Transfer template sends one anonymous GET for a static JavaScript file. Treat a match as a strong lead to confirm on the server, and treat silence as unknown.\"\n          }\n        }\n      ]\n    },\n    {\n      \"@type\": \"TechArticle\",\n      \"headline\": \"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server - Advisory + Nuclei Detection\",\n      \"description\": \"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.\",\n      \"url\": \"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\",\n      \"author\": {\n        \"@type\": \"Organization\",\n        \"name\": \"Sn1perSecurity LLC\"\n      },\n      \"publisher\": {\n        \"@type\": \"Organization\",\n        \"name\": \"Sn1perSecurity LLC\"\n      },\n      \"about\": [\n        {\n          \"@type\": \"Thing\",\n          \"name\": \"CVE-2026-84295\"\n        },\n        {\n          \"@type\": \"Thing\",\n          \"name\": \"CVE-2026-90868\"\n        },\n        {\n          \"@type\": \"Thing\",\n          \"name\": \"CVE-2026-90865\"\n        },\n        {\n          \"@type\": \"SoftwareApplication\",\n          \"name\": \"Progress WS_FTP Server\",\n          \"operatingSystem\": \"Windows\",\n          \"applicationCategory\": \"Managed file transfer\"\n        }\n      ]\n    }\n  ]\n}\n<\/script><\/p>\n<div id=\"wp-share-button-67958\" class=\"wp-share-button theme28\"><span class=\"total-share \"><i class=\"total-count-text\">Total Share<\/i> <i class=\"total-count\">0<\/i> <\/span><a target=\"_blank\" href=\"https:\/\/www.facebook.com\/sharer\/sharer.php?u=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\" class=\"share-button share-button-67958 facebook\" id=\"facebook\" data-nonce=\"7193ea00ed\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Facebook<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/twitter.com\/intent\/tweet?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/&amp;text=CVE-2026-84295:%20Pre-Auth%20Authentication%20Bypass%20in%20Progress%20WS_FTP%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection\" class=\"share-button share-button-67958 twitter\" id=\"twitter\" data-nonce=\"7193ea00ed\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Twitter<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"http:\/\/www.reddit.com\/submit?title=CVE-2026-84295:%20Pre-Auth%20Authentication%20Bypass%20in%20Progress%20WS_FTP%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\" class=\"share-button share-button-67958 reddit\" id=\"reddit\" data-nonce=\"7193ea00ed\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Reddit<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/shareArticle?url=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/&amp;title=CVE-2026-84295:%20Pre-Auth%20Authentication%20Bypass%20in%20Progress%20WS_FTP%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;summary=&amp;source=\" class=\"share-button share-button-67958 linkedin\" id=\"linkedin\" data-nonce=\"7193ea00ed\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Linkedin<\/span>\r\n\r\n<span class=\"button-count\">0<\/span>\r\n\r\n<\/a>\r\n\r\n<a title=\"More...\" href=\"#wp-share-button-67958\" class=\"share-button-more\"><span class=\"button-icon\"><i class=\"fa fa-plus\"><\/i><\/span><\/a><div class=\"wp-share-button-popup wp-share-button-popup-67958\"><div class=\"popup-buttons\"><span class=\"close\">X<\/span><a target=\"_blank\" href=\"mailto:?subject=CVE-2026-84295:%20Pre-Auth%20Authentication%20Bypass%20in%20Progress%20WS_FTP%20Server%20\u2013%20Advisory%20+%20Nuclei%20Detection&amp;body=https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\" class=\"share-button share-button-67958 email\" id=\"email\">\r\n\r\n<span class=\"button-icon\"><\/span>\r\n<span class=\"button-name\">Email<\/span>\r\n<span class=\"button-count\">0<\/span>\t\t\t\t\r\n\r\n<\/a>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>CVE-2026-84295 is a CVSS 10.0 pre-auth Progress WS_FTP Server vulnerability that discloses administrative credentials. It is fixed in 2024.0.6 and 2025.0.3, but twelve more CVEs from the same 29 October 2026 bulletin, including two OS command injections, need 2024.0.7 or 2025.0.4. Both fix trains, passive Nuclei templates that read the version WS_FTP announces before login, and how to find every WS_FTP server on your attack surface with Sn1per.<\/p>\n","protected":false},"author":1,"featured_media":67959,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[290,99,184,289,338,335],"tags":[],"class_list":["post-67958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-attack-surface-management","category-cves","category-news","category-penetration-testing","category-threat-intelligence","category-vulnerability-scanning"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"xer0dayz\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Sn1perSecurity\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per\" \/>\n\t\t<meta property=\"og:description\" content=\"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-31T14:36:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-31T14:36:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per\" \/>\n\t\t<meta name=\"twitter:description\" content=\"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@sn1persecurity\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#blogposting\",\"name\":\"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per\",\"headline\":\"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection\",\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png\",\"width\":1200,\"height\":630},\"datePublished\":\"2026-10-31T07:36:07-07:00\",\"dateModified\":\"2026-10-31T07:36:07-07:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#webpage\"},\"articleSection\":\"Attack Surface Management, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/cves\\\/#listItem\",\"name\":\"CVE's\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/cves\\\/#listItem\",\"position\":2,\"name\":\"CVE's\",\"item\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/cves\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#listItem\",\"name\":\"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#listItem\",\"position\":3,\"name\":\"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/category\\\/cves\\\/#listItem\",\"name\":\"CVE's\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\",\"name\":\"Sn1perSecurity\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"email\":\"support@sn1persecurity.com\",\"foundingDate\":\"2021-10-05\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"value\":2},\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/Sn1perwhiteandcircleicontwitter.jpg\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#organizationLogo\",\"width\":500,\"height\":500,\"caption\":\"Sn1perSecurity Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Sn1persecurity-105784611869093\",\"https:\\\/\\\/x.com\\\/sn1persecurity\",\"https:\\\/\\\/www.instagram.com\\\/sn1persecurity\",\"https:\\\/\\\/www.youtube.com\\\/sn1persecurity\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/sn1persecurity\\\/\",\"https:\\\/\\\/github.com\\\/1N3\\\/Sn1per\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/\",\"name\":\"xer0dayz\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e5f1a4e7b520f257ee62dcb2a44274bc57e37aa9fe3e3dcd511755464f80f636?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"xer0dayz\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#webpage\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/\",\"name\":\"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per\",\"description\":\"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/author\\\/xer0dayz\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#mainImage\",\"width\":1200,\"height\":630},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\\\/#mainImage\"},\"datePublished\":\"2026-10-31T07:36:07-07:00\",\"dateModified\":\"2026-10-31T07:36:07-07:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#website\",\"url\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/\",\"name\":\"Sn1perSecurity\",\"alternateName\":\"Sn1per\",\"description\":\"Get an attacker's view of your organization with our all-in-one offensive security platform\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/sn1persecurity.com\\\/wordpress\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","description":"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.","canonical_url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#blogposting","name":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","headline":"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection","author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","width":1200,"height":630},"datePublished":"2026-10-31T07:36:07-07:00","dateModified":"2026-10-31T07:36:07-07:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#webpage"},"isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#webpage"},"articleSection":"Attack Surface Management, CVE's, News, Penetration Testing, Threat Intelligence, Vulnerability Scanning"},{"@type":"BreadcrumbList","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/#listItem","position":1,"name":"Home","item":"https:\/\/sn1persecurity.com\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/#listItem","name":"CVE's"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/#listItem","position":2,"name":"CVE's","item":"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/","nextItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#listItem","name":"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection"},"previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#listItem","position":3,"name":"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection","previousItem":{"@type":"ListItem","@id":"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/#listItem","name":"CVE's"}}]},{"@type":"Organization","@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization","name":"Sn1perSecurity","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","url":"https:\/\/sn1persecurity.com\/wordpress\/","email":"support@sn1persecurity.com","foundingDate":"2021-10-05","numberOfEmployees":{"@type":"QuantitativeValue","value":2},"logo":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1perwhiteandcircleicontwitter.jpg","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#organizationLogo","width":500,"height":500,"caption":"Sn1perSecurity Logo"},"image":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","https:\/\/x.com\/sn1persecurity","https:\/\/www.instagram.com\/sn1persecurity","https:\/\/www.youtube.com\/sn1persecurity","https:\/\/www.linkedin.com\/in\/sn1persecurity\/","https:\/\/github.com\/1N3\/Sn1per"]},{"@type":"Person","@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author","url":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/","name":"xer0dayz","image":{"@type":"ImageObject","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/e5f1a4e7b520f257ee62dcb2a44274bc57e37aa9fe3e3dcd511755464f80f636?s=96&d=mm&r=g","width":96,"height":96,"caption":"xer0dayz"}},{"@type":"WebPage","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#webpage","url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/","name":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","description":"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#website"},"breadcrumb":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#breadcrumblist"},"author":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"creator":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/author\/xer0dayz\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#mainImage","width":1200,"height":630},"primaryImageOfPage":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/#mainImage"},"datePublished":"2026-10-31T07:36:07-07:00","dateModified":"2026-10-31T07:36:07-07:00"},{"@type":"WebSite","@id":"https:\/\/sn1persecurity.com\/wordpress\/#website","url":"https:\/\/sn1persecurity.com\/wordpress\/","name":"Sn1perSecurity","alternateName":"Sn1per","description":"Get an attacker's view of your organization with our all-in-one offensive security platform","inLanguage":"en-US","publisher":{"@id":"https:\/\/sn1persecurity.com\/wordpress\/#organization"}}]},"og:locale":"en_US","og:site_name":"Sn1perSecurity","og:type":"article","og:title":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","og:description":"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.","og:url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/","og:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","og:image:secure_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","og:image:width":"1200","og:image:height":"630","article:published_time":"2026-10-31T14:36:07+00:00","article:modified_time":"2026-10-31T14:36:07+00:00","article:publisher":"https:\/\/www.facebook.com\/Sn1persecurity-105784611869093","twitter:card":"summary_large_image","twitter:site":"@sn1persecurity","twitter:title":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","twitter:description":"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.","twitter:creator":"@sn1persecurity","twitter:image":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png"},"aioseo_meta_data":{"post_id":"67958","title":"CVE-2026-84295: WS_FTP Server Vulnerability | Sn1per","description":"CVE-2026-84295 is a CVSS 10.0 pre-auth WS_FTP Server flaw that leaks admin credentials. Both fix versions, all 15 CVEs, and a passive Nuclei template.","keywords":null,"keyphrases":{"focus":{"keyphrase":"CVE-2026-84295","score":0,"analysis":[]}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","og_image_width":"1200","og_image_height":"630","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"featured","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-10-31 14:36:07","updated":"2026-10-31 15:52:45","seo_analyzer_scan_date":null,"focus_keyword":"CVE-2026-84295","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/\" title=\"CVE&apos;s\">CVE's<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tCVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server \u2013 Advisory + Nuclei Detection\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/sn1persecurity.com\/wordpress\/"},{"label":"CVE's","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/cves\/"},{"label":"CVE-2026-84295: Pre-Auth Authentication Bypass in Progress WS_FTP Server &#8211; Advisory + Nuclei Detection","link":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per\/"}],"jetpack_shortlink":"https:\/\/wp.me\/pdnW96-hG6","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":67128,"url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-88771-citrix-netscaler-preauth-rce-detection-with-sn1per\/","url_meta":{"origin":67958,"position":0},"title":"CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Pre-Auth RCE Detection with Sn1per","author":"xer0dayz","date":"October 1, 2026","format":false,"excerpt":"CVE-2026-88771 and CVE-2026-88772 are actively exploited Citrix NetScaler RCE zero-days in CISA KEV. Get the passive Nuclei template, the four-branch patch-gap logic, and how to detect unpatched appliances at scale with Sn1per.","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"CVE-2026-88771 and CVE-2026-88772 Citrix NetScaler pre-auth RCE, fixed build per line","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/10\/cve-88771-cover.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/10\/cve-88771-cover.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/10\/cve-88771-cover.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/10\/cve-88771-cover.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/10\/cve-88771-cover.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":65542,"url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-61511-vbulletin-preauth-rce-detection-with-sn1per\/","url_meta":{"origin":67958,"position":1},"title":"CVE-2026-61511: Pre-Auth Remote Code Execution in vBulletin (runMaths) &#8211; Advisory + Nuclei Detection","author":"xer0dayz","date":"July 31, 2026","format":false,"excerpt":"CVE-2026-61511 is a critical unauthenticated RCE in vBulletin 5.x and 6.x, caused by eval injection in the runMaths() template handler. A plain-English advisory, a tested non-destructive Nuclei detection template, the 6.x patch-level trap that hides unpatched hosts, and how to find vulnerable vBulletin at scale with Sn1per.","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"Sn1perSecurity advisory cover: CVE-2026-61511 unauthenticated eval injection RCE in vBulletin runMaths, with a Nuclei detection template and Sn1per attack surface detection","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/07\/cve-2026-61511-vbulletin.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":26771,"url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2024-21733-apache-tomcat-http-request-smuggling\/","url_meta":{"origin":67958,"position":2},"title":"CVE-2024-21733 Apache Tomcat HTTP Request Smuggling","author":"xer0dayz","date":"January 21, 2024","format":false,"excerpt":"Our security research team recently discovered a critical \"0day\" vulnerability which was assigned CVE-2024-21733. The vulnerability was discovered by xer0dayz from Sn1perSecurity LLC and allows attackers to force a victim's browser to de-synchronize its connection with websites hosted on top of Apache Tomcat, causing sensitive data to be smuggled from\u2026","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"CVE-2024-21733 Apache Tomcat HTTP Request Smuggling","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2024\/01\/CVE-2024-21733.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":17988,"url":"https:\/\/sn1persecurity.com\/wordpress\/vmware-workspace-one-access-freemarker-ssti-cve-2022-22954-detection-with-sn1per-professional\/","url_meta":{"origin":67958,"position":3},"title":"VMware Workspace ONE Access freemarker SSTI (CVE-2022-22954) Detection with Sn1per Professional","author":"xer0dayz","date":"April 14, 2022","format":false,"excerpt":"Information regarding a critical 0-day vulnerability affecting the VMware Workspace ONE Access and Identity Manager was disclosed and designated CVE-2022-22954 which allows an un-authenticated attacker to execute arbitrary code on vulnerable servers. On April 14th, CISA & US-Cert added CVE-2022-22954 to their catalog of known exploited vulnerabilities after a number\u2026","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/04\/Sn1per-cve-2022-22954-detection1.png?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":66330,"url":"https:\/\/sn1persecurity.com\/wordpress\/cve-2026-82329-jfrog-artifactory-auth-bypass-detection-with-sn1per\/","url_meta":{"origin":67958,"position":4},"title":"CVE-2026-82329: JFrog Artifactory Auth Bypass Detection with Sn1per","author":"xer0dayz","date":"September 3, 2026","format":false,"excerpt":"CVE-2026-82329 is a critical, unauthenticated JFrog Artifactory authentication bypass in CISA KEV. Get the passive Nuclei template, the six-branch version logic, and how to detect it at scale with Sn1per.","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"CVE-2026-82329 JFrog Artifactory unauthenticated admin takeover, fixed release per branch","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/09\/cve-82329-cover.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/09\/cve-82329-cover.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/09\/cve-82329-cover.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/09\/cve-82329-cover.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/09\/cve-82329-cover.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":18544,"url":"https:\/\/sn1persecurity.com\/wordpress\/confluence-rce-ognl-template-injection-cve-2022-26134\/","url_meta":{"origin":67958,"position":5},"title":"Confluence RCE via OGNL template injection (CVE-2022-26134)","author":"xer0dayz","date":"June 5, 2022","format":false,"excerpt":"A critical vulnerability affecting the Atlassian Confluence was disclosed and designated CVE-2022-26134 which allows an un-authenticated attacker to execute arbitrary code on vulnerable servers. A number of Proof-of-Concept (PoC) exploits were published online and exploit activity is actively being observed. Given the impact and severity of the vulnerability, Sn1perSecurity has\u2026","rel":"","context":"In &quot;Attack Surface Management&quot;","block_context":{"text":"Attack Surface Management","link":"https:\/\/sn1persecurity.com\/wordpress\/category\/attack-surface-management\/"},"img":{"alt_text":"Sn1per-CVE-2022-26134-detection1","src":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2022\/06\/Sn1per-CVE-2022-26134-detection1.png?resize=1400%2C800&ssl=1 4x"},"classes":[]}],"jetpack_featured_media_url":"https:\/\/sn1persecurity.com\/wordpress\/wp-content\/uploads\/2026\/06\/cve-2026-84295-ws-ftp-auth-bypass-detection-with-sn1per.png","_links":{"self":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/67958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/comments?post=67958"}],"version-history":[{"count":0,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/posts\/67958\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media\/67959"}],"wp:attachment":[{"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/media?parent=67958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/categories?post=67958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sn1persecurity.com\/wordpress\/wp-json\/wp\/v2\/tags?post=67958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}