CVE-2026-90869
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Risk Assessment
The SSH service can be disrupted for all users, causing denial of file transfer access and operational disruption.
Recommendation
Update WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later) and consider restricting access to the SSH service.
Other vulnerabilities in WS_FTP Server
See all- CVE-2023-40044CriticalActively exploited
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- CVE-2026-90867High
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
- CVE-2026-90862Medium
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user's password to access certain files associated with that account without satisfying multi-factor authentication requirements.
- CVE-2026-90861Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
- CVE-2026-84296Medium
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
- CVE-2026-84294High
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
- CVE-1999-0362Medium
WS_FTP server is vulnerable to a remote denial of service (DoS) attack through the cwd command.
Original NVD description (English source)
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS