Critical Vulnerability in Progress Software WS_FTP Exploited in the Wild (CVE-2023-40044)

On September 27, Progress Software, published an advisory for several vulnerabilities in its WS_FTP Server secure file transfer solution including two critical flaws:

• CVE-2023-40044
• CVE-2023-42657

CVE-2023-40044, the most critical of the two, was assigned a CVSSv3 score of 10.0 by Progress Software. Two days after publishing its advisory, a public proof-of-concept (PoC) became available on the social media platform X (formerly known as Twitter).  One day later, reports emerged of in-the-wild exploitation of this vulnerability.

For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.