lee1981 (@lee1981b) on X

What it is

CyberForge CVE of the Day #091 covers two Progress WS_FTP Server vulnerabilities on Windows, both scored by Progress's CNA under CVSS v3.1. CVE-2026-84295 scores 10.0 (CWE-287, CWE-522): unauthenticated network access to sensitive information, including administrative credentials. CVE-2026-90868 scores 9.9 (CWE-78, CWE-88): OS command and argument injection that needs only low privileges (PR:L) and applies under certain configurations. Both vectors use Scope: Changed. WS_FTP Professional Client and MOVEit are separate products and are not covered.

Preconditions / Affected

Fixed floors differ per CVE, which creates a partial-repair state:

• Before 2024.0.6 (9.0.6) or 2025.0.3 (10.0.3): both issues are in scope.
• At 2024.0.6 or 2025.0.3: only 84295 is fixed. These releases are dated 3 September 2026.
• At 2024.0.7 (9.0.7) or 2025.0.4 (10.0.4), or a later repaired release: both are fixed. These are dated 1 October 2026.

Compare builds within the same release family only. Do not declare unlisted older branches unaffected.

The conditions for 90868 are not public. The CNA mentions shell operators, but the page says the command-building site, the exact low-privilege role, the execution account and the configuration remain unknown. The entry point, file and credential format for 84295 are also unidentified.

Status signals (as of 29 October 2026)

• NVD: both records are Awaiting Analysis, so the scores are the CNA's only.
• CISA KEV: neither ID is in the 29 October 2026 catalogue of 1,764 entries.
• FIRST EPSS: no data exists for either CVE. This means unavailable, not zero.
• CISA SSVC: Exploitation:none and Technical Impact:total for both. Automatable:yes for 84295 and Automatable:no for 90868.
• Exploitation: no active campaign and no verified public PoC. A secondary discovery result claims a public exploit for 84295, but it was not verified.
• Finders: Luu Tien Thanh (thalu93) for 84295 and Yash Kumar Kumawat (ykk0x) for 90868.

What to do

1. Patch both CVEs by moving to 2024.0.7/9.0.7 or 2025.0.4/10.0.4, then verify the running build on every node, including failover nodes. An installer or inventory entry is not enough.
2. Treat identity as a separate workstream. Updating does not revoke exposed credentials or existing sessions, so identity owners should rotate and revoke, then verify the effect.
3. Plan to leave the 2024 (9.0) line. It reached Sunset on 23 October 2026 and will be Retired on 23 April 2027, so it gets no further service packs or hot fixes. The 2025 (10.0) line is Active, with Sunset on 10 December 2027.
4. Check upgrade prerequisites. The 2025 installer uses PowerShell for registry encryption settings. Failover upgrades from before 10.0.0 need manual registry synchronization for shared-database secret decryption.
5. Confirm logging coverage before hunting. Progress documents the levels None, Errors Only, Normal and Verbose. Normal includes file and folder actions, authentication and SITE commands. Verbose adds connection and protocol detail. Existing sessions pick up a level change only after logout and login.
6. For process evidence, use Windows Security event 4688. It needs process auditing enabled, and command-line content needs its own inclusion policy. The page's two example checks are Get-WinEvent ListLog (log metadata only) and a 4688 query on an EVTX copy capped at 200 newest matches. The commands themselves are in the full report, not on this page.
7. Both CNAs direct customers to Progress Technical Support for mitigation. No universal workaround was verified.

Caveats

• No CVE-specific IOC was verified: no IP, domain, hash, URI or command string. A shell process, a SITE command or a new source address is context to correlate, not an indicator.
• A credential-to-command-execution chain is a hypothesis. No primary source demonstrates it, and no combined score exists. Do not average the two scores.
• The four Progress Fixed Issues pages inspected do not name either CVE. Do not attribute unrelated fixes on them to this pair.
• The 4688 and ListLog commands were only syntax-parsed. Nothing was run, and no detector was deployed.
• A clean search does not clear a server. Missing 4688 data may reflect missing coverage, and enabling auditing now cannot recreate past events.