CVE-2026-90861
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
Risk Assessment
Clear-text password exposure may let a lower-privileged administrator escalate to full administrative control of the server.
Recommendation
Update WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later) and rotate passwords for accounts that may have been exposed.
Other vulnerabilities in WS_FTP Server
See all- CVE-2023-40044CriticalActively exploited
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- CVE-2026-90869High
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- CVE-2026-90867High
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
- CVE-2026-90862Medium
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user's password to access certain files associated with that account without satisfying multi-factor authentication requirements.
- CVE-2026-84296Medium
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
- CVE-2026-84294High
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
- CVE-1999-0362Medium
WS_FTP server is vulnerable to a remote denial of service (DoS) attack through the cwd command.
Original NVD description (English source)
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS