{"id":"CVE-2023-40044","aliases":["EUVD-2023-44651","GHSA-29vf-j74g-gmfc"],"status":"published","title":"WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability","description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.90355,"percentile":0.99801,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-502"],"published":"2023-09-27T14:48:08Z","modified":"2026-06-17T06:15:55Z","kev":{"date_added":"2023-10-05","due_date":"2023-10-26","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2023-10-05"},{"source":"kev","since":"2023-10-05"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/ws_ftp_rce_cve_2023_40044","title":"Progress Software WS_FTP Unauthenticated Remote Code Execution","type":"exploit","platform":"Windows","date":"2023-09-27","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/ws_ftp_rce_cve_2023_40044"},{"source":"pocgithub","id":"kenbuckler/WS_FTP-CVE-2023-40044","title":"kenbuckler/WS_FTP-CVE-2023-40044","date":"2023-10-02","url":"https://github.com/kenbuckler/WS_FTP-CVE-2023-40044"},{"source":"nuclei","id":"CVE-2023-40044","title":"WS_FTP Server - Insecure Deserialization","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40044.yaml"}],"products":[{"vendor":"progress","product":"ws_ftp server"},{"vendor":"progress","product":"ws_ftp_server"},{"vendor":"progress software corporation","product":"ws_ftp server"}],"references":[{"url":"https://www.progress.com/ws_ftp","tags":["product","x_transferred","Product"]},{"url":"https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.theregister.com/2023/10/02/ws_ftp_update/","tags":["x_transferred","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/","tags":["x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044","tags":["x_transferred","Third Party Advisory"]},{"url":"https://censys.com/cve-2023-40044/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40044"},{"url":"https://censys.com/cve-2023-40044"},{"url":"https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server"},{"url":"https://www.theregister.com/2023/10/02/ws_ftp_update"},{"url":"https://github.com/advisories/GHSA-29vf-j74g-gmfc"}],"sources":{"cve":[{"id":"CVE-2023-40044","title":"WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability","description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.","status":"published","published":"2023-09-27T14:48:08.19Z","modified":"2025-10-21T23:05:36.645Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-44651","description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.","status":"published","published":"2023-09-27T14:48:08Z","modified":"2025-10-21T23:05:36Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-10-05","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-29vf-j74g-gmfc","title":"In WS_FTP Server version 8.7.0 prior to 8.7.4 and\n\n version 8.8.0 prior to 8.8.2, a pre...","description":"In WS_FTP Server version 8.7.0 prior to 8.7.4 and\n\n version 8.8.0 prior to 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.  ","status":"published","published":"2023-09-27T15:30:35Z","modified":"2025-10-22T00:32:51Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2023-40044","title":"Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability","description":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.","cwes":["CWE-502"],"kev":{"date_added":"2023-10-05","due_date":"2023-10-26","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-40044","description":"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.","status":"published","published":"2023-09-27T15:18:57.307Z","modified":"2026-06-17T06:15:55.11Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:08:31.699785Z"}]}}