Overview
CVE-2026-115339 is a denial-of-service vulnerability in Progress Software's WS_FTP Server for Windows. The flaw stems from insufficient resource limits (CWE-770, allocation of resources without limits or throttling), allowing an unauthenticated remote attacker to exhaust server resources. It was published on 2026-11-09 and carries a CVSS 3.1 base score of 7.5 (High).
Technical Details
| Field | Value |
|---|---|
| CVE | CVE-2026-115339 |
| CVSS 3.1 vector | AV:N/AC:L/PR:N/UI:N/A:H |
| Weakness | CWE-770 |
| Affected | WS_FTP Server on Windows, all releases before 2025.0.5 |
| Fixed in | 2025.0.5 |
| Authentication | None required |
| KEV status | Not listed at time of writing |
The vector indicates network-reachable exploitation with low complexity, no privileges, and no user interaction. Impact is limited to availability — there is no confidentiality or integrity impact in the CVSS vector. Some third-party aggregators label the issue as memory exhaustion in the XFT component; that label has not been confirmed against the vendor advisory.
Related Fixes in the Same Service Pack
Progress's November 2026 WS_FTP Server Service Pack addresses several other CVEs in releases before 2025.0.5. Per CVE aggregator listings (not verified against the vendor advisory):
- CVE-2026-115336 — incorrect quota accounting letting an authenticated user exceed storage quotas, potentially causing DoS (CVSS 6.5)
- CVE-2026-115337 — improper access control (CVSS 6.3)
- CVE-2026-115338 — insufficient protection of communications (CVSS 8.1)
- CVE-2026-115340 — sensitive credential and session data written to a temporary file during transfers (CVSS 7.1)
- CVE-2026-115341 — path traversal in the Thin Client Web Transfer component (CVSS 7.7)
Remediation
- Upgrade WS_FTP Server to 2025.0.5 or later. Patching is manual for self-hosted installs.
- Review the vendor advisory, "WS-FTP-Server-Service-Pack-November-2026," on the Progress Community site for the authoritative list of fixes.
- Until patched, restrict inbound access to FTP/SFTP/HTTPS transfer ports to known partner IP ranges, and place the server behind a firewall or WAF that can rate-limit connections.
- Monitor for abnormal memory and connection growth on the WS_FTP host.
WS_FTP has been a recurring target for attackers, so treat file-transfer servers as high-priority patching candidates even when a given flaw is "only" a DoS.