Thank you for your clarification.

We have already selected WinSCP 6.5.7 for integration into our product and completed our internal OSS registration and catalog application for that version.

Could you please clarify whether WinSCP 6.5.7 is still supported and acceptable for continued use in a product, or whether upgrading to WinSCP 6.7 is required?

Specifically, would security fixes still be provided for the 6.5.7 branch, or is only the latest 6.7 release currently supported?

The CVE-2026-45447 should have no impact on any version of WinSCP.

In any case, the WinSCP 6.3.5 is two years old and not supported. Please upgrade to the latest version.

Hello,

We use WinSCP 6.3.5 on Windows 11 IoT Enterprise LTSC 2024 only as an FTPS client with the following configuration:

• File protocol: FTP
  
• Encryption: TLS/SSL Explicit encryption
  
• Connection target: a fixed CT system IP address
  
• Port number: 990
  
• Passive mode: disabled
  
• GUI operation
  

We do not use SFTP, SCP, SSH, Pageant, SSH private keys, or intentionally process PKCS#7 or S/MIME signed messages.

WinSCP 6.5.7 includes security fixes from PuTTY and OpenSSL, including the fix for CVE-2026-45447 related to PKCS#7 signature verification.

Could you please confirm the following?

1. Is WinSCP 6.3.5 affected by CVE-2026-45447 when used only for the FTPS configuration described above?
   
2. Does the FTPS/TLS connection path in WinSCP invoke the affected PKCS#7 signature verification processing?
   
3. Are any other security fixes included in WinSCP 6.5.7 applicable to this FTPS-only usage?
   
4. Is an update from WinSCP 6.3.5 to 6.5.7 required for this usage from a security perspective?
   

Thank you.