Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Progress · WS_FTP Server
The flaw is a .NET deserialization of untrusted data vulnerability in the Ad Hoc Transfer module of Progress WS_FTP Server. It affects WS_FTP Server versions prior to 8.7.4 and 8.8.2. An attacker with network access can exploit it without authenticating to execute remote commands on the underlying operating system of the WS_FTP Server.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 3/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 4 days after disclosure. Public exploit code (Metasploit) was available the same day.
- First seen exploitedVulnCheck KEV evidence+4 days
- Added to CISA KEVknown ransomware use; EU database agrees+8 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3ExecutionTA0002
Zero-day .NET deserialization vulnerability that allows an adversary to make an HTTP POST request to a vulnerable WS_FTP Server and execute commands.
Stealth
Command and ControlTA0011
Detection
0 rules for this CVE · 136 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-40044 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Indirect Command ExecutionT120241 general rules
- Custom File Open Handler Executes PowerShellhightest
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXEhightest
- Outlook EnableUnsafeClientMailRules Setting Enabledhightest
- Potential Arbitrary Command Execution Using Msdt.EXEhightest
- Potential Arbitrary File Download Using Office Applicationhightest
- Potentially Suspicious Office Document Executed From Trusted Locationhightest
- Renamed NirCmd.EXE Executionhightest
- Renamed PAExec Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- 44 more on OTX