Summary
- Ireland's NCSC issued an advisory covering two critical WS_FTP Server vulnerabilities.
- CVE-2026-84295 concerns authentication and sensitive information exposure, while CVE-2026-90868 involves command injection.
- Progress has issued fixes for affected 2024 and 2025 product branches.
Ireland’s National Cyber Security Centre has warned organisations about two critical security vulnerabilities affecting Progress WS_FTP Server, a managed file transfer application used to exchange business information with internal users and external partners. The warning concerns weaknesses that can expose sensitive credentials or permit the execution of commands on affected Windows servers under different conditions.
The national advisory issued on 30 October identifies CVE-2026-84295 and CVE-2026-90868. Both are rated critical, but they involve different components and different exploitation requirements. Progress’s product advisories specify the vulnerable software versions and the fixes needed on the supported 2024 and 2025 branches. Administrators need to assess both weaknesses when determining whether an installation is protected.
CVE-2026-84295 involves an authentication weakness that may allow an unauthenticated remote attacker to obtain sensitive information, including administrator credentials. Its CVSS severity score is 10.0. If an attacker obtained valid administrative credentials, the impact would depend on the privileges available in WS_FTP Server and whether the credentials were also used elsewhere in the organisation.
CVE-2026-90868 instead concerns command injection, with a CVSS score of 9.9. Progress’s account identifies configuration and low-privilege access preconditions for the issue. Describing both vulnerabilities simply as unauthenticated remote code execution would erase that distinction and overstate the reach of the second weakness. The conditions under which commands can be executed matter when assessing which deployed systems are exposed.
The fix thresholds differ as well. The authentication weakness affects releases before WS_FTP Server 2024.0.6 and 2025.0.3. The command-injection weakness requires the later 2024.0.7 and 2025.0.4 releases. An organisation that installed an earlier security update may therefore still be vulnerable to the newer issue, even if it believes its WS_FTP environment was recently patched.
WS_FTP Server occupies a sensitive place in enterprise operations because managed file transfer systems hold documents exchanged between employees, customers, suppliers, and other partners. Some transfers are initiated manually, while others run on schedules or through integrations with financial, logistics, or operational applications. A failure in the platform can affect more than its immediate software installation.
Transfer services may keep dedicated accounts for partners, permissions governing particular directories, and credentials required for downstream workflows. Exposure of administrative information could place both the platform and connected processes at risk. By contrast, an ability to execute unintended commands on the underlying host could threaten system integrity and availability, with consequences shaped by the rights of the affected process.
The two mechanisms therefore require different lines of technical inquiry during a response. For credential exposure, administrators may need to identify which secrets were accessible, review authentication records, and determine whether any issued credentials should be invalidated. For command injection, the central questions concern the relevant application configuration, accessible account privileges, and any evidence of unexpected process execution.
Businesses often rely on managed file transfer services for records they must retain or deliver within agreed timeframes. Taking a service offline for maintenance can delay payment files, supplier information, or scheduled exchanges with customers. However, leaving an externally reachable vulnerable service running can extend the period in which the published weaknesses might be exploited.
Those dependencies make the release inventory important. Teams need to know which product branch is installed and which integrations rely on it before scheduling an update. Testing the repaired deployment should include the operation of relevant transfers, authentication arrangements, and permissions rather than confirming only that the service starts successfully after installation.
The Irish NCSC alert does not establish that the two CVEs have been exploited against Irish businesses. Nor does it provide a verified count of compromised WS_FTP installations. Previous incidents involving managed file transfer products show why such services attract attention, but those separate events cannot be used as evidence of exploitation of these particular flaws.
Where managed file transfer is outsourced, responsibility for patching and incident investigation may be divided between the software owner, hosting provider, and organisation exchanging the data. Effective remediation depends on knowing who manages the underlying Windows server, who approves application upgrades, and who can review historical access to the service.
Progress’s advisories supply the version information and technical conditions needed to assess exposure, while the Irish NCSC has highlighted the vulnerabilities for organisations in its jurisdiction. The separate fixed-release thresholds mean that the newer patch level, rather than the presence of any recent update, is the decisive factor in protecting against both issues.
