6.6
MediumCVSS 3.1 · from ProgressSoftware
CVE-2026-90872
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
WS_FTP Server · CWE-95 · CWE-95AffectedWS_FTP Server
FixUpdate to 2024.0.7, 2025.0.4 or newer
PublishedOct 29, 15:57 · ProgressSoftware
ScoredOct 29 · 6.6 · ProgressSoftware
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
From ProgressSoftware
Affected and fixed versions
ProductAffectedFixed inWS_FTP Serverbefore 2024.0.72024.0.7WS_FTP Serverbefore 2025.0.42025.0.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known