CVE-1999-0362
MediumExploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
WS_FTP server is vulnerable to a remote denial of service (DoS) attack through the cwd command.
Risk Assessment
An attacker can remotely disable the server, leading to service unavailability for users.
Recommendation
It is recommended to update the WS_FTP server to the latest version to mitigate this vulnerability.
Other vulnerabilities in WS_FTP server
See all- CVE-2023-40044CriticalActively exploited
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- CVE-2026-90869High
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- CVE-2026-90867High
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
- CVE-2026-90862Medium
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user's password to access certain files associated with that account without satisfying multi-factor authentication requirements.
- CVE-2026-90861Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
- CVE-2026-84296Medium
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
- CVE-2026-84294High
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
Original NVD description (English source)
WS_FTP server remote denial of service through cwd command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS