Improper authentication in Progress Software WS_FTP Server allows an unauthenticated remote attacker to gain access to sensitive information, including administrative credentials, through the server’s authentication mechanisms. The flaw is a classic authentication bypass (CWE‑287) combined with a sensitive information exposure (CWE‑522). As a result, an attacker may exfiltrate credential data or potentially gain broader administrative control if the exposed credentials are further used.

The vulnerability affects Progress Software’s WS_FTP Server on Windows platforms. Specifically, any deployment running a version earlier than 2024.0.6 or 2025.0.3 is susceptible. No other products or operating systems were mentioned as impacted.

The CVSS score of 10 indicates a critical severity. EPSS is not available, so the probability of exploitation in the wild is unknown, and the issue is not listed in CISA’s KEV catalog, implying no documented public exploits at this time. The likely attack vector is remote over the network, exploiting the FTP service’s authentication interface without any credential or user context. Given the potential for credential compromise and subsequent administrative access, the risk to affected organizations is high and warrants immediate attention.