Back securityvulnerability.io

Missing Authorization in Progress Software WS_FTP Server High & Critical Vulnerabilities / 6h Progress Software - Ws Ftp Server - CRITICAL - CVE-2026-90863. A missing authorization flaw in the administrative interface of Progress Software's WS_FTP Server allows a delegated Host Administrator to manipulate system settings beyond their intended permissions. This vulnerability can lead to arbitrary command execution, granting unauthorized users the ability to execute operations with elevated privil

securityvulnerability.io • October 29, 2026

A missing authorization flaw in the administrative interface of Progress Software's WS_FTP Server allows a delegated Host Administrator to manipulate system settings beyond their intended permissions. This vulnerability can lead to arbitrary command execution, granting unauthorized users the ability to execute operations with elevated privileges, thereby risking the complete compromise of the underlying server.

WS_FTP Server Windows 0 < 2024.0.7

WS_FTP Server Windows 0 < 2025.0.4

Download the Critical Vulnerability Management Cheat Sheet

Vulnerability published Oct 29, 2026

Vulnerability published

Vulnerability Reserved Sep 14, 2026

Vulnerability Reserved

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Progress WS_FTP Server Disclosed On October 29, 2026, Progress Software disclosed two critical vulnerabilities in its WS_FTP Server: CVE-2026-84295 and CVE-2026-90868. CVE-2026-84295, rated CVSS 10.0, allows unauthenticated remote attackers to access sensitive information, including administrative credentials. CVE-2026-90868, rated CVSS 9.9, is an OS command injection flaw that can enable arbitrary command execution under certain configurations. Both vulnerabilities were patched in versions 2024.0.6 and 2025.0.3, released earlier in September and October 2026. As of the disclosure date, there is no evidence of exploitation in the wild, and neither vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Organizations using WS_FTP Server are advised to upgrade to the latest versions and review access permissions for administrative accounts. 4 sources 71

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)