CVE-2026-90867
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Risk Assessment
An attacker may reach administrative functionality over the network, risking server takeover and unauthorized configuration changes.
Recommendation
Update WS_FTP Server to version 2024.0.7 or 2025.0.4 (or later) and restrict Web Admin console access to trusted networks.
Other vulnerabilities in WS_FTP Server
See all- CVE-2023-40044CriticalActively exploited
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- CVE-2026-90869High
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- CVE-2026-90862Medium
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user's password to access certain files associated with that account without satisfying multi-factor authentication requirements.
- CVE-2026-90861Medium
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
- CVE-2026-84296Medium
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.
- CVE-2026-84294High
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
- CVE-1999-0362Medium
WS_FTP server is vulnerable to a remote denial of service (DoS) attack through the cwd command.
Original NVD description (English source)
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS