{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","source":"CNA: ProgressSoftware","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-115340","cwes":["CWE-312","CWE-522"],"description":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.","epss":{"date":"2026-11-12","percentile":0.00164,"score":0.00081},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: ProgressSoftware","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":7.1,"severity":"high","source":"NVD: security@progress.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794503844640,"publishedAt":1794242851408,"references":[{"source":"CNA: ProgressSoftware","tags":["vendor-advisory"],"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"},{"source":"security@progress.com","tags":[],"url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"remediation":[{"kind":"workaround","source":"CNA: ProgressSoftware","text":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."}],"revision":"3b4a9fc74ff16ff9e53b2deae5bc6bd63f0917170c54e7b5510e3d8101ef57ef","sources":[{"modifiedAt":1794502078302,"name":"CNA: ProgressSoftware","retrievedAt":1794503327918,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115340"},{"modifiedAt":1794503844640,"name":"NVD","retrievedAt":1794507413695,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115340"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794503331160,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115340"}],"ssvc":{"assessedAt":1794502058585,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server","updatedAt":1794507413695}