{"api_version":"1","generated_at":"2026-11-10T14:04:40+00:00","cve":"CVE-2026-115340","urls":{"html":"https://cve.report/CVE-2026-115340","api":"https://cve.report/api/cve/CVE-2026-115340.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-115340","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-115340"},"summary":{"title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server","description":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-11-09 17:17:11","updated_at":"2026-11-09 17:17:11"},"problem_types":["CWE-312","CWE-522","CWE-312 CWE-312: Cleartext Storage of Sensitive Information","CWE-522 CWE-522: Insufficiently Protected Credentials"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026","name":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115340","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115340","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software","product":"WS_FTP Server","version":"affected 2025.0.5 custom","platforms":["Windows"]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Momen Elmady (0xmatrix)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Momen Elmady (0xmatrix)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."}],"value":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."}],"impacts":[{"descriptions":[{"lang":"en","value":"Collect Data from Common Resource Locations"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-312","description":"CWE-312: Cleartext Storage of Sensitive Information","lang":"en","type":"CWE"},{"cweId":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T16:47:31.408Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"source":{"discovery":"EXTERNAL"},"title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}],"value":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-115340","datePublished":"2026-11-09T16:47:31.408Z","dateReserved":"2026-10-22T10:41:52.792Z","dateUpdated":"2026-11-09T16:47:31.408Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-09 17:17:11","lastModifiedDate":"2026-11-09 17:17:11","problem_types":["CWE-312","CWE-522","CWE-312 CWE-312: Cleartext Storage of Sensitive Information","CWE-522 CWE-522: Insufficiently Protected Credentials"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"115340","Ordinal":"1","Title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP ","CVE":"CVE-2026-115340","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"115340","Ordinal":"1","NoteData":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.","Type":"Description","Title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP "}]}}}