CVE-2026-90872
MediumCVSS 6.6Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper neutralization of directives in dynamically evaluated code in the Manager web console. An authenticated Manager administrator could exploit this to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Risk Assessment
An authenticated administrator could execute arbitrary commands with IIS worker process privileges, potentially leading to server compromise. This may compromise system confidentiality, integrity, and availability.
Recommendation
Update Progress Software WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later). Restrict administrative privileges and monitor web console activity.
Other vulnerabilities in Progress Software WS_FTP Server
See all- CVE-2026-90871Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper limitation of a pathname to a restricted directory. An unauthenticated attacker could exploit this to affect files outside the intended directory.
- CVE-2026-90870Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to a missing release of backend receiver sessions in the Ad Hoc Transfer component. This could lead to server resource exhaustion and service degradation.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
- CVE-2026-84295Critical
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
Original NVD description (English source)
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS