CVE-2026-90870
MediumCVSS 5.3Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to a missing release of backend receiver sessions in the Ad Hoc Transfer component. This could lead to server resource exhaustion and service degradation.
Risk Assessment
Failure to release sessions could lead to server resource exhaustion, causing service degradation or unavailability. This may disrupt operational activities.
Recommendation
Update Progress Software WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later). Monitor resource usage and restart the service if necessary.
Other vulnerabilities in Progress Software WS_FTP Server
See all- CVE-2026-90872Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper neutralization of directives in dynamically evaluated code in the Manager web console. An authenticated Manager administrator could exploit this to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
- CVE-2026-90871Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper limitation of a pathname to a restricted directory. An unauthenticated attacker could exploit this to affect files outside the intended directory.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
- CVE-2026-84295Critical
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Original NVD description (English source)
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS