9.1
CriticalCVSS 3.1 · from ProgressSoftware
CVE-2026-90863
Privilege Escalation via Missing Authorization in WS_FTP Manager
WS_FTP Server · CWE-915 · CWE-915AffectedWS_FTP Server
FixUpdate to 2024.0.7, 2025.0.4 or newer
PublishedOct 29, 15:49 · ProgressSoftware
ScoredOct 29 · 9.1 · ProgressSoftware
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
From ProgressSoftware
Affected and fixed versions
ProductAffectedFixed inWS_FTP Serverbefore 2024.0.72024.0.7WS_FTP Serverbefore 2025.0.42025.0.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known