Loading story…
Progress WS_FTP Server's Ad Hoc Transfer (AHT) component is vulnerable to unauthenticated remote code execution tracked as CVE-2023-40044. An attacker with network access to the WS_FTP web server can submit a crafted multipart HTTP request that delivers attacker-controlled Base64 data to a .NET BinaryFormatter deserialization sink in the MyFileUpload.UploadModule IIS HTTP module, allowing arbitrary command execution without credentials.
The issue affects WS_FTP Server releases before 8.7.4 and 8.8.2; Progress fixes are available in WS_FTP Server 2020.0.4 (8.7.4) and 2022.0.2 (8.8.2). Researchers estimated roughly 2,900 internet-exposed WS_FTP hosts could be reachable, and warned that URL-only WAF rules may not detect exploitation because the IIS module processes requests throughout the AHT application; defenders should patch and inspect multipart request content for malicious serialized payloads.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Searchlight Cyber published research on CVE-2023-40044, detailing an unauthenticated RCE path in the WS_FTP Ad Hoc Transfer component. The research identified attacker-controlled BinaryFormatter deserialization in the MyFileUpload.UploadModule and estimated roughly 2,900 internet-exposed WS_FTP hosts could be reachable.
An independent researcher publicly released a proof of concept for CVE-2023-40044 on Twitter/X after Progress released its patch.
Progress addressed CVE-2023-40044 in WS_FTP Server 2020.0.4 (8.7.4) and WS_FTP Server 2022.0.2 (8.8.2). The flaw allows unauthenticated command execution through unsafe deserialization in the Ad Hoc Transfer application.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical pre-authentication flaw in Progress MOVEit Transfer, **CVE-2023-34362**, was actively exploited to compromise internet-facing managed file-transfer servers and steal customer data. The vulnerability allowed SQL injection over HTTP/HTTPS, enabling attackers to manipulate the database, establish privileged sessions, deploy the `human2.aspx` ASPX webshell, and access or exfiltrate stored files. Microsoft attributed the campaign to Lace Tempest, associated with the Cl0p extortion ecosystem; Cl0p subsequently demanded that victims make contact or face publication of stolen data. Technical analysis found that duplicate HTTP-header smuggling could bypass `MOVEitISAPI.dll` transaction restrictions and set attacker-controlled session variables. Those values reached vulnerable guest-access code, permitting creation of a `sysadmin` session, acquisition of an API token, and a path to remote code execution through resumable-upload metadata and unsafe .NET `BinaryFormatter` deserialization. Organizations were urged to apply Progress updates, restrict HTTP/HTTPS exposure until patched, hunt for `human2.aspx`, the `Health Check Service` account or session, and `X-siLock-*` headers, preserve logs, rotate relevant storage credentials, and rebuild compromised servers from trusted backups because patching alone does not remove persistence.
Sep 3, 2026
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026
A four-CVE chain in Telerik UI for ASP.NET AJAX's `RadAsyncUpload` component can allow unauthenticated remote code execution in affected ASP.NET WebForms applications. **CVE-2026-13182** exposes an AES-CBC padding oracle in encrypted client-state handling, enabling recovery and forgery of configuration data; the reported chain also uses decrypt-versus-parse behavior, a predictable HMAC key, and a type-name deserialization gadget. Forged configuration can permit DLL uploads, after which unsafe upload-metadata type resolution in **CVE-2026-13181** can load a malicious mixed-mode DLL and execute code in the IIS worker process. The full chain includes CVE-2026-13181 through CVE-2026-13184. Affected Telerik UI for ASP.NET AJAX releases range from `2010.1.309` through `2026.2.519`; Progress Software remediated the issues in version `2026.2.708`. Exploitation requires an exposed vulnerable `RadAsyncUpload` page whose `FileUploaded` handler reads `UploadResult`, plus an explicitly configured non-default `Telerik.AsyncUpload.ConfigurationEncryptionKey`. Organizations should upgrade immediately, review RadAsyncUpload pages and event handlers, and investigate unusual IIS child processes, temporary DLLs, and unexpected ASPX files.
Sep 7, 2026