CVE-2023-40044Used in ransomware
Progress WS_FTP Server
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
What it is
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
- nvd.nist.gov/vuln/detail/CVE-2023-40044
Description and required action as published by CISA. Full record at NVD.
Other Progress entries on the list
- LoadMaster Progress LoadMaster Command Injection Vulnerability CVE-2026-8037 · Aug 7, 2026
- WhatsUp Gold Progress WhatsUp Gold Path Traversal Vulnerability CVE-2024-4885 · Mar 3, 2025
- Kemp LoadMaster Progress Kemp LoadMaster OS Command Injection Vulnerability CVE-2024-1212 · Nov 18, 2024
- WhatsUp Gold Progress WhatsUp Gold SQL Injection Vulnerability CVE-2024-6670 · Sep 16, 2024
- Telerik Report Server Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability CVE-2024-4358 · Jun 13, 2024
- MOVEit Transfer Progress MOVEit Transfer SQL Injection Vulnerability CVE-2023-34362 · Jun 2, 2023