CVE-2026-90863 - Exploits & Severity

Missing authorization in the administrative interface of Progress Software WS_FTP Server (Windows) before 2024.0.7 and 2025.0.4 allows a delegated Host Administrator to exceed their authorized scope, potentially leading to arbitrary command execution with elevated privileges and full compromise of the underlying server.

A delegated Host Administrator can exceed their authorized administrative scope and execute arbitrary commands with elevated privileges, leading to complete compromise of the underlying server.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch available in versions 2024.0.7 and 2025.0.4 or later

Upgrade Progress Software WS_FTP Server (Windows) to version 2024.0.7, 2025.0.4, or later. Review and audit delegated Host Administrator accounts and their access permissions to identify any unauthorized activities. Implement principle of least privilege for administrative accounts.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-90863 . See article

NVD published the first details for CVE-2026-90863

A CVSS base score of 9.1 has been assigned.

GitHub Advisories released a security advisory .

Links to Mitre Att&cks

[GHSA-gpxj-xcv2-8mhf] Missing authorization in the administrative interface of Progress Software WS_FT

CVE-2026-90868 - Exploits & Severity - Feedly

[critical] Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4

Progress WS_FTP Server CVE-2026-84295 and CVE-2026-90868: Critical Flaws Fixed in 2024.0.7 and 2025.0.4

Missing Authorization in Progress Software WS_FTP Server

CVE-2026-90863 | Progress WS_FTP Server up to 2024.0.6/2025.0.3 Administrative Interface improper authorization

Be the first to know critical vulnerabilities

Collect, analyze, and vulnerability reports faster using AI