Clear Text Password Vulnerability in Progress Software WS_FTP Server
CVE-2026-90861

6.6MEDIUM

Key Information:

Vendor

Progress Software
Status
Ws Ftp Server
Vendor
CVE Published:
29 October 2026

What is CVE-2026-90861?

A security issue has been identified in Progress Software's WS_FTP Server, where specific versions expose user passwords in clear text. This vulnerability could allow unauthorized administrators to capture these passwords, potentially granting them expanded access to the server and sensitive information. Users of affected versions are strongly advised to upgrade to the latest versions to mitigate this risk.

Affected Version(s)

WS_FTP Server Windows 0 < 2024.0.7

WS_FTP Server Windows 0 < 2025.0.4

References

https://progress.lightning.force.com/lightning/r/Knowledg...
vendor-advisory

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Niv Levy (restricted)
.