The vulnerability is an authentication bypass flaw in the SSH component of Progress WS_FTP Server that allows an authenticated user to circumvent multi‑factor authentication (MFA) requirements. By incorrectly associating authentication factors between different user accounts, an attacker who already possesses valid credentials can gain full access without providing the second factor. This flaw permits unauthorized access to the FTP service and the data stored or transmitted through it, potentially exposing sensitive information and enabling further exploitation of the server.

Progress Software WS_FTP Server running on Windows is impacted. Versions earlier than 2024.0.6 and 2025.0.3 are vulnerable; newer releases beyond those versions contain the fix.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The flaw can be exploited by an attacker who has already authenticated to the system, so an active, authenticated user is the primary attack vector. Once successful, the attacker can proceed without MFA and potentially access or modify any data or operations available to the user account.