VulnSocial

CVE-2023-40044Active Exploitation(progress / ws_ftp_server)

LOWCVSS 8.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for progress ws_ftp_server systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

progress CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2023-10-26. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ws_ftp_server

Threat summary

  • Active exploitation appears in 1 classified signals
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
progress
Products
ws_ftp_server

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-17: 1Active Exploitation · 2026-06-17: 1Technical Details · 2026-06-17: 106-17
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
Full discourse1 post
  • ThreatCluster@threatcluster
    Active Exploitation

    CVE-2023-40044, a deserialization bug in Progress WS_FTP Server's Ad Hoc Transfer module enabling unauthenticated RCE on versions before 8.7.4 and 8.8.2, was added to CISA's Known Exploited Vulnerabilities list, Rapid7 reported. https://threatcluster.io/cluster/critical-rce-vulnerability-in-ws_ftp-server-disclosed-541d254b

    Post summary

    CVE-2023-40044, a deserialization bug allowing unauthenticated RCE in Progress WS_FTP Server prior to versions 8.7.4 and 8.8.2, has been identified as actively exploited and added to CISA’s Known Exploited Vulnerabilities list.

    0000064
    356 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appprogressws_ftp_server---

Explore more

Back to dashboardprogress CVEsws_ftp_server vulnerabilities