GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-40044 (GCVE-0-2023-40044)

Vulnerability from cvelistv5 – Published: 2023-09-27 14:48 – Updated: 2025-10-21 23:05
VLAI CISA Shadowserver Previdian
Title
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
Summary
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-03 16:29 UTC
CWE
  • CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
Vendor Product Version CPE status
Progress Software Corporation WS_FTP Server Affected: 8.8.0 , < 8.8.2 (semver)
Affected: 8.7.0 , < 8.7.4 (semver)
guessed Create a notification for this product.
Date Public
2023-09-27 14:47
Credits
Shubham Shah - Assetnote Sean Yeoh - Assetnote
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 3ea914ee-a850-4f6b-913b-b848fe79b325

Vulnerability ID: CVE-2023-40044

Status: Confirmed

Status Updated: 2023-10-05 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2023-10-05
Asserted: 2023-10-05
Scope
Notes: KEV entry: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | Affected: Progress / WS_FTP Server | Description: Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-26 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://nvd.nist.gov/vuln/detail/CVE-2023-40044
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-502
Feed CISA Known Exploited Vulnerabilities Catalog
Product WS_FTP Server
Due Date 2023-10-26
Date Added 2023-10-05
Vendorproject Progress
Vulnerabilityname Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Knownransomwarecampaignuse Known
References
Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 1e76b4e7-da20-478b-8e79-4b9ae1a42440

Vulnerability ID: CVE-2023-40044

Status: Confirmed

Status Updated: 2024-09-27 15:32 UTC

Exploited: Yes

Characteristics
Severity: 88.0
Timestamps
First Seen: 2024-09-27
Asserted: 2024-09-27
Last Seen: 2024-09-27
Scope
Asset Exposure: ['internet-facing']
Notes: Affected: Progress / WS_FTP Server | Class: file-transfer | Severity: High (CVSS 8.8) | IoT: no | In CISA KEV: yes | Honeypot connections on 2024-09-27: 2
Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details
1D 2
Iot no
Feed Shadowserver Foundation honeypot/exploited-vulnerabilities
Type http-scan
Class file-transfer
7D Avg 0
Vendor Progress
30D Avg 0
90D Avg 0
Product WS_FTP Server
Cisa Kev yes
Connections 2
Observation Date 2024-09-27
Vulnerability Class CVSS
Vulnerability Score 8.8
Vulnerability Severity High
References
Created: 2026-06-30 10:22 UTC | Updated: 2026-06-30 12:19 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 8a0c5329-9a98-48a2-86fa-0a69edf6d728

Vulnerability ID: CVE-2023-40044

Status: Confirmed

Status Updated: 2023-10-05 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2023-10-05
Asserted: 2023-10-05
Scope
Notes: KEVIntel entry: WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability | Affected: Progress Software Corporation / WS_FTP Server | CVSS: 10.0 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
Vendor Progress Software Corporation
Product WS_FTP Server
Added Date 2023-10-05T00:00:00.000Z
Cvss Score 10.0
Epss Score None
Cvss Severity CRITICAL
Epss Percentile None
Used In Malware yes
Ahead Of Cisa Kev None
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:05 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:24:54.913Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.progress.com/ws_ftp"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://censys.com/cve-2023-40044/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40044",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-03T16:29:04.428335Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-10-05",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:36.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-10-05T00:00:00.000Z",
            "value": "CVE-2023-40044 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Ad Hoc Transfer Module"
          ],
          "product": "WS_FTP Server",
          "vendor": "Progress Software Corporation",
          "versions": [
            {
              "lessThan": "8.8.2",
              "status": "affected",
              "version": "8.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.7.4",
              "status": "affected",
              "version": "8.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Shubham Shah - Assetnote"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Sean Yeoh - Assetnote"
        }
      ],
      "datePublic": "2023-09-27T14:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn WS_FTP Server versions prior to 8.7.4 and 8.8.2\u003c/span\u003e, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.\u0026nbsp;\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-04T16:06:10.768Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://www.progress.com/ws_ftp"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
        },
        {
          "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
        },
        {
          "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
        },
        {
          "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
        },
        {
          "url": "https://censys.com/cve-2023-40044/"
        },
        {
          "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
        },
        {
          "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2023-40044",
    "datePublished": "2023-09-27T14:48:08.190Z",
    "dateReserved": "2023-08-08T19:44:41.112Z",
    "dateUpdated": "2025-10-21T23:05:36.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-40044",
      "cwes": [
        "CWE-502"
      ],
      "dateAdded": "2023-10-05",
      "dueDate": "2023-10-26",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://nvd.nist.gov/vuln/detail/CVE-2023-40044",
      "product": "WS_FTP Server",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.",
      "vendorProject": "Progress",
      "vulnerabilityName": "Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability"
    },
    "epss": {
      "cve": "CVE-2023-40044",
      "date": "2026-09-17",
      "epss": "0.9015",
      "percentile": "0.9979"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-10-26",
      "cisaExploitAdd": "2023-10-05",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability",
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "443CCFDE-4A61-40F1-96C1-B36BF9240773",
                  "versionEndExcluding": "8.7.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "670AEEB3-B2B3-41DA-8188-4F1A4E02F0AD",
                  "versionEndExcluding": "8.8.2",
                  "versionStartIncluding": "8.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\nIn WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.\u00a0\u00a0\n\n"
        },
        {
          "lang": "es",
          "value": "En las versiones del servidor WS_FTP anteriores a la 8.7.4 y 8.8.2, un atacante previamente autenticado podr\u00eda aprovechar una vulnerabilidad de deserializaci\u00f3n de .NET en el m\u00f3dulo Ad Hoc Transfer para ejecutar comandos remotos en el sistema operativo subyacente del servidor WS_FTP."
        }
      ],
      "id": "CVE-2023-40044",
      "lastModified": "2024-11-21T08:18:35.380",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10.0,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 6.0,
            "source": "security@progress.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-09-27T15:18:57.307",
      "references": [
        {
          "source": "security@progress.com",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://censys.com/cve-2023-40044/"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Exploit"
          ],
          "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.progress.com/ws_ftp"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
        },
        {
          "source": "security@progress.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://censys.com/cve-2023-40044/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit"
          ],
          "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.progress.com/ws_ftp"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
        }
      ],
      "sourceIdentifier": "security@progress.com",
      "vulnStatus": "Undergoing Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ],
          "source": "security@progress.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "affected",
                "modules": [
                  "Ad Hoc Transfer Module"
                ],
                "product": "WS_FTP Server",
                "vendor": "Progress Software Corporation",
                "versions": [
                  {
                    "lessThan": "8.8.2",
                    "status": "affected",
                    "version": "8.8.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.7.4",
                    "status": "affected",
                    "version": "8.7.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@progress.com"
          }
        ],
        "cisaActionDue": "2023-10-26",
        "cisaExploitAdd": "2023-10-05",
        "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "443CCFDE-4A61-40F1-96C1-B36BF9240773",
                    "versionEndExcluding": "8.7.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:progress:ws_ftp_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "670AEEB3-B2B3-41DA-8188-4F1A4E02F0AD",
                    "versionEndExcluding": "8.8.2",
                    "versionStartIncluding": "8.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system."
          },
          {
            "lang": "es",
            "value": "En las versiones del servidor WS_FTP anteriores a la 8.7.4 y 8.8.2, un atacante previamente autenticado podr\u00eda aprovechar una vulnerabilidad de deserializaci\u00f3n de .NET en el m\u00f3dulo Ad Hoc Transfer para ejecutar comandos remotos en el sistema operativo subyacente del servidor WS_FTP."
          }
        ],
        "id": "CVE-2023-40044",
        "lastModified": "2026-06-17T06:15:55.110",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "security@progress.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-40044",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-03T16:29:04.428335Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-09-27T15:18:57.307",
        "references": [
          {
            "source": "security@progress.com",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://censys.com/cve-2023-40044/"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Product"
            ],
            "url": "https://www.progress.com/ws_ftp"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
          },
          {
            "source": "security@progress.com",
            "tags": [
              "Press/Media Coverage",
              "Third Party Advisory"
            ],
            "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://censys.com/cve-2023-40044/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product"
            ],
            "url": "https://www.progress.com/ws_ftp"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Broken Link",
              "Third Party Advisory"
            ],
            "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Press/Media Coverage",
              "Third Party Advisory"
            ],
            "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044"
          }
        ],
        "sourceIdentifier": "security@progress.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "security@progress.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T11:19:09+00:00",
      "cve": "CVE-2023-40044",
      "id": "CVE-2023-40044",
      "initial_release_date": "2023-09-27T14:47:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-40044.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T18:24:54.913Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "product",
                  "x_transferred"
                ],
                "url": "https://www.progress.com/ws_ftp"
              },
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://censys.com/cve-2023-40044/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-40044",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-03T16:29:04.428335Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2023-10-05",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-03T16:29:15.338Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2023-10-05T00:00:00.000Z",
                "value": "CVE-2023-40044 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "modules": [
                "Ad Hoc Transfer Module"
              ],
              "product": "WS_FTP Server",
              "vendor": "Progress Software Corporation",
              "versions": [
                {
                  "lessThan": "8.8.2",
                  "status": "affected",
                  "version": "8.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.7.4",
                  "status": "affected",
                  "version": "8.7.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Shubham Shah - Assetnote"
            },
            {
              "lang": "en",
              "type": "finder",
              "user": "00000000-0000-4000-9000-000000000000",
              "value": "Sean Yeoh - Assetnote"
            }
          ],
          "datePublic": "2023-09-27T14:47:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn WS_FTP Server versions prior to 8.7.4 and 8.8.2\u003c/span\u003e, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.\u0026nbsp;\u0026nbsp;\u003c/p\u003e"
                }
              ],
              "value": "In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-586",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-586 Object Injection"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-502",
                  "description": "CWE-502 Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-04T16:06:10.768Z",
            "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
            "shortName": "ProgressSoftware"
          },
          "references": [
            {
              "tags": [
                "product"
              ],
              "url": "https://www.progress.com/ws_ftp"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023"
            },
            {
              "url": "https://www.theregister.com/2023/10/02/ws_ftp_update/"
            },
            {
              "url": "https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/"
            },
            {
              "url": "https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044"
            },
            {
              "url": "https://censys.com/cve-2023-40044/"
            },
            {
              "url": "https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044"
            },
            {
              "url": "http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "assignerShortName": "ProgressSoftware",
        "cveId": "CVE-2023-40044",
        "datePublished": "2023-09-27T14:48:08.190Z",
        "dateReserved": "2023-08-08T19:44:41.112Z",
        "dateUpdated": "2025-10-21T23:05:36.645Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.