Hello,

We use WinSCP 6.3.5 on Windows 11 IoT Enterprise LTSC 2024 only as an FTPS client with the following configuration:

- File protocol: FTP
- Encryption: TLS/SSL Explicit encryption
- Connection target: a fixed CT system IP address
- Port number: 990
- Passive mode: disabled
- GUI operation

We do not use SFTP, SCP, SSH, Pageant, SSH private keys, or intentionally process PKCS#7 or S/MIME signed messages.

WinSCP 6.5.7 includes security fixes from PuTTY and OpenSSL, including the fix for CVE-2026-45447 related to PKCS#7 signature verification.

Could you please confirm the following?

1. Is WinSCP 6.3.5 affected by CVE-2026-45447 when used only for the FTPS configuration described above?
2. Does the FTPS/TLS connection path in WinSCP invoke the affected PKCS#7 signature verification processing?
3. Are any other security fixes included in WinSCP 6.5.7 applicable to this FTPS-only usage?
4. Is an update from WinSCP 6.3.5 to 6.5.7 required for this usage from a security perspective?

Thank you.