CVE-2023-40044: Progress WS_FTP Server .NET deserialization leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a pre-authentication network-reachable RCE in an edge service, listed in CISA KEV with known ransomware use and a very high EPSS score.

What it is

WS_FTP Server versions prior to 8.7.4 and 8.8.2 contain a .NET deserialization flaw in the Ad Hoc Transfer module. An attacker can trigger deserialization of untrusted data to run commands on the underlying operating system. The flaw is remotely reachable and has been exploited in the wild, including in ransomware campaigns.

Impact

Successful exploitation gives the attacker remote command execution on the WS_FTP Server host, allowing full compromise of the server and any data or credentials it holds. Because the server often sits at a network edge, it can serve as a foothold for lateral movement.

Attack surface

The vulnerability is network-reachable through the Ad Hoc Transfer module, which is exposed via IIS HTTP modules. The CVSS vector lists PR:L, but the description and public exploit references describe the attacker as pre-authenticated, so the exact authentication requirement is inconsistent in the record.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-10-05 with known ransomware campaign use, and EPSS gives a 30-day probability of 0.9015 (99.79th percentile). Public exploit code is referenced, so exploitation is active and widespread.

What to do

• Upgrade WS_FTP Server to 8.7.4 or 8.8.2 (or later) immediately.
• If patching cannot be done at once, follow the vendor advisory's mitigation guidance or take the server offline.
• Restrict network access to the WS_FTP Server and its Ad Hoc Transfer endpoints to trusted sources only.
• Rotate credentials and secrets stored or processed by the WS_FTP Server host after patching.
• Review the host for signs of compromise before returning it to service.

Detection

• Monitor WS_FTP Server and IIS logs for unexpected requests to Ad Hoc Transfer endpoints, especially malformed or serialized payloads.
• Alert on child processes spawned by the WS_FTP Server or IIS worker process (w3wp.exe), such as cmd.exe, powershell.exe or net.exe.
• Hunt for outbound connections or file writes from the WS_FTP Server host that do not match normal FTP operations.
• Check for newly created local accounts, scheduled tasks or services on the WS_FTP Server host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.