Progress Software, as the CVE numbering authority, published six CVE records for WS_FTP Server on 9 November 2026 (UTC; 10 November in Perth), each referencing Progress's WS_FTP Server Service Pack November 2026 article. CVE-2026-115338 (CVSS 3.1 8.1): insufficient protection of communications in WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

CVE-2026-115341 (7.7): improper access restrictions in the Thin Client Web Transfer component could allow an authenticated FTP user to access files outside their intended scope. CVE-2026-115339 (7.5): insufficient resource limits could allow an unauthenticated remote attacker to cause denial of service. CVE-2026-115340 (7.1): the server may write sensitive user credential and session data to a temporary file during file transfer operations.

CVE-2026-115336 (6.5): incorrect quota accounting could let an authenticated user with upload and delete permissions exceed storage quotas. CVE-2026-115337 (6.3): improper access control could let an authenticated user with certain folder-management permissions access or modify files belonging to other users. The records do not say any flaw has been exploited (source: CVE records, Progress Software CNA).