CVE-2023-40044β€”Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

PUBLISHEDvulnerability record
2023-10-05 Β· last modified June 21, 2025

Metadata

CVE ID:
CVE-2023-40044
Project:
Progress
Product:
WS_FTP Server
Date Added:
2023-10-05
Due Date:
2023-10-26
Last Updated:
June 21, 2025

Vulnerability Name

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

Description

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:
KNOWN

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

  • https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
  • https://nvd.nist.gov/vuln/detail/CVE-2023-40044

Related Weaknesses

browse all CVEs