CVE-2026-90870 is a vulnerability in Progress Software WS_FTP Server affecting versions prior to 2024.0.7 and 2025.0.4 on Windows. It involves uncontrolled resource consumption due to missing release of backend receiver sessions in the Ad Hoc Transfer component. This can lead to server resource exhaustion and service degradation. The issue has a medium severity with a CVSS score of 5.3 and is fixed in versions 2024.0.7 and 2025.0.4.
CVE-2026-90869 is a high-severity vulnerability in Progress Software WS_FTP Server affecting versions prior to 2024.0.7 and 2025.0.4 on Windows. It allows a remote attacker who knows a valid account's enrolled SSH public key to cause an out-of-bounds read, resulting in termination of the shared SSH service. This denial-of-service condition impacts availability but does not affect confidentiality or integrity.
CVE-2026-90868 is a critical OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. Successful exploitation could allow an attacker with limited privileges to execute arbitrary commands with high impact on confidentiality, integrity, and availability.
CVE-2026-90867 is an improper access control vulnerability in the Web Admin console of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow remote unauthenticated attackers to access administrative functionality. The vulnerability has a high severity with a CVSS score of 8.1. Fixed versions 2024.0.7 and 2025.0.4 are available.
CVE-2026-90866 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access unauthorized filesystem locations, potentially leading to remote code execution.
CVE-2026-90865 is an OS command injection vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. The flaw could allow an attacker to execute arbitrary commands with elevated privileges under certain configurations. This vulnerability has a critical CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 are available.
CVE-2026-90864 is a critical path traversal vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. A delegated Host Administrator could exploit this flaw to access or modify files outside their authorized directory scope. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. Fixed versions 2024.0.7 and 2025.0.4 address this issue.
A missing authorization vulnerability exists in the administrative interface of Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4. This flaw allows a delegated Host Administrator to perform actions beyond their authorized scope, potentially leading to arbitrary command execution with elevated privileges and full compromise of the server.
CVE-2026-90862 is an improper authentication vulnerability in the Web Transfer Module of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. An attacker who has a user's password could access certain files associated with that account without completing multi-factor authentication. The vulnerability has a medium severity with a CVSS score of 4.3.
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may log user passwords in clear text, exposing them to other administrators. This vulnerability allows an administrator with access to logs to obtain another user's password, potentially escalating privileges and gaining broader administrative control of the server.
CVE-2026-84296 is a Multi-Factor Authentication (MFA) bypass vulnerability in the SSH component of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.6 and 2025.0.3. The flaw allows authenticated users to bypass MFA requirements due to improper association of authentication factors between accounts. This vulnerability has a medium severity with a CVSS score of 6.8. Fixed versions 2024.0.6 and 2025.0.3 are available.
CVE-2026-84295 is a critical improper authentication vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.6 and 2025.0.3. An unauthenticated remote attacker could exploit this flaw to gain access to sensitive information, including administrative credentials. The vulnerability has a CVSS score of 10.0, indicating a severe impact on confidentiality, integrity, and availability. Fixed versions 2024.0.6 and 2025.0.3 are available to remediate this issue.
RT-Labs P-Net versions before 1.0.3 contain a vulnerability where the RPC session allocated for requests naming unknown interface or object UUIDs is not released and no timeout is started. This leads to exhaustion of available sessions when repeated requests with different activity UUIDs are made, causing the device to stop responding to new RPC requests until restarted. This can be exploited remotely without authentication to cause a denial of service.
CVE-2026-115794 is a low-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves improper handling of a length parameter in the application alarm callback, where the data length derived from a received alarm frame is not validated against the actual frame length. This can cause the callback to receive an excessively large length value, potentially leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected. The issue is fixed in version 1.0.3.
CVE-2026-115795 is an out-of-bounds read vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs because the software does not verify the presence of a complete block header before reading subsequent blocks in DCP Set and Identify requests. This can lead to reading memory beyond the buffer boundary or processing a block with an incorrect length, potentially causing a crash or limited memory disclosure. Exploitation requires adjacent network access.
CVE-2026-111736 is a high-severity vulnerability in RT-Labs P-Net before version 1.0.3. It involves a NULL pointer dereference in the function pf_fspm_cm_read_ind() when processing an implicit read request lacking a valid target AR UUID for a user-specific record index, provided the application has registered a read callback. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device.
RT-Labs P-Net versions before 1.0.3 contain a resource management vulnerability where Application Relationships (AR) and RPC sessions are not released after rejecting RPC requests with incorrect endianness data representation. This leads to session exhaustion, causing the device to stop responding to new RPC requests until restarted. The flaw allows a remote unauthenticated attacker to cause a denial of service.
CVE-2026-84294 is a high-severity vulnerability in Progress Software WS_FTP Server affecting versions prior to 2024.0.6 and 2025.0.3 on Windows. It involves improper limitation of pathname in the Ad Hoc Transfer component, allowing an authenticated user to access files outside the intended directories. This vulnerability has been fixed in versions 2024.0.6 and 2025.0.3.
CVE-2026-111735 is an integer underflow vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs in the pf_cpm_c_data_ind() function when processing a received cyclic data frame in specific consumer states. A crafted short frame causes a 16-bit arithmetic underflow in the offset calculation, leading to out-of-bounds memory reads. This can result in a denial of service crash or disclosure of memory contents. The issue is fixed in version 1.0.3.
CVE-2026-111734 is an out-of-bounds read vulnerability in RT-Labs P-Net before version 1.0.3. The vulnerability arises because the function pf_eth_recv() does not properly validate the length of received Ethernet frames before reading fields such as EtherType, VLAN tags, and PROFINET FrameID. Specifically, the VLAN tag processing loop lacks an upper bound, which can cause the function to read beyond the end of the receive buffer when processing truncated frames or frames composed solely of VLAN tags. This can lead to a denial of service via a crash or unintended disclosure of memory contents.