Progress WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Remote Code Execution (RCE) - CVE-2023-40044
Executive & SecOps Summary
SECOPS ASSESSMENTProgress WS_FTP Server versions prior to 8.7.4 and 8.8.2 with Ad Hoc Transfer module enabled
A pre-authenticated remote attacker can execute arbitrary OS commands with IIS worker process privileges by sending a crafted .NET serialized payload
Immediately upgrade to patched versions (8.7.4, 8.8.2, or higher) or disable/remove the Ad Hoc Transfer module
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading WS_FTP Server to version 8.7.4, 8.8.2, or later.
Use the following PowerShell commands to stop services and prepare for the upgrade installer:
# Stop WS_FTP services before running the official installer
Stop-Service -Name 'Ipswitch WS_FTP Web Server' -Force
Stop-Service -Name 'WS_FTP Server' -Force
# Execute the downloaded installer silently (example for 8.8.2)
Start-Process -FilePath '.\WS_FTP_Server_8.8.2_Install.exe' -ArgumentList '/s /v"/qn"' -Wait2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable or remove the vulnerable Ad Hoc Transfer (AHT) module from IIS.
Run the following PowerShell commands to remove the AHT application and stop its application pool:
Import-Module WebAdministration
# Remove the Ad Hoc Transfer application and virtual directory
Remove-WebApplication -Site 'Default Web Site' -Name 'AHT'
Remove-WebVirtualDirectory -Site 'Default Web Site' -Name 'AHT'
# Stop the associated IIS Application Pool
Stop-WebAppPool -Name 'AHTPool'3. Log Audit & IoC Verification Commands
Inspect IIS logs and process creation events to detect potential exploitation attempts.
# Search IIS logs for POST requests targeting the Ad Hoc Transfer (AHT) endpoint
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Pattern '/AHT/' |
Where-Object { $_ -match 'POST' } |
Select-Object -First 50
# Check if the IIS worker process (w3wp.exe) spawned suspicious child processes
Get-CimInstance Win32_Process | Where-Object {
$_.ParentProcessId -in (Get-Process -Name w3wp -ErrorAction SilentlyContinue).Id
} | Select-Object ProcessId, Name, CommandLine, CreationDateBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-40044) is a critical .NET deserialization flaw within the 'Ad Hoc Transfer' module of Progress WS_FTP Server. The root cause lies in the insecure deserialization (CWE-502) of untrusted user input processed by the IIS HTTP modules implementing the Ad Hoc Transfer functionality. The application fails to validate or restrict the types being deserialized, allowing arbitrary object instantiation.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can target the vulnerable endpoint without any valid credentials. The exploitation flow typically proceeds as follows:
- The attacker generates a malicious .NET serialization payload using tools like
ysoserial.net, leveraging gadget chains such asActivitySurrogateSelector. - The payload is transmitted via an HTTP POST request to the Ad Hoc Transfer web interface.
- Upon receiving the request, the WS_FTP Server's backend .NET application deserializes the payload, triggering the execution of embedded system commands under the security context of the IIS worker process (
w3wp.exe).
3. Infrastructure & Business Impact
With a CVSS score of 8.8 (High) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an immediate threat. Successful exploitation grants the attacker remote code execution capabilities on the underlying Windows operating system. This can lead to complete system compromise, data exfiltration of sensitive files transferred via FTP, deployment of ransomware, and lateral movement within the internal network.
Official Vendor Advisories & References
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Frequently Asked SecOps Questions (CVE-2023-40044)
FAQQ1. How critical is CVE-2023-40044 and is it actively exploited in the wild?
CVE-2023-40044 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 90.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-40044?
Primary impacted vendors include progress across ws_ftp_server. Scope summary: Progress WS_FTP Server versions prior to 8.7.4 and 8.8.2
Q3. What temporary mitigations or workarounds exist for CVE-2023-40044 before patching?
[Mitigation] Immediately upgrade to patched versions (8.7.4, 8.8.2, or higher) or disable/remove the Ad Hoc Transfer module Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-40044
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
JetBrains TeamCity Unauthenticated Remote Code Execution Vulnerability via Agent Polling Protocol (CVE-2026-63077)
[Affected Scope] JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.