OS Command Injection Vulnerability in Progress Software WS_FTP Server
CVE-2026-90865

9CRITICAL

Key Information:

Vendor

Progress Software
Status
Ws Ftp Server
Vendor
CVE Published:
29 October 2026

What is CVE-2026-90865?

An OS command injection vulnerability exists in the WS_FTP Server from Progress Software, where certain configurations on Windows could permit an attacker to execute arbitrary commands with elevated privileges. This could compromise the security of the server and the systems it interacts with, highlighting the importance of updating affected versions to mitigate potential exploitation.

Affected Version(s)

WS_FTP Server Windows 0 < 2024.0.7

WS_FTP Server Windows 0 < 2025.0.4

References

https://progress.lightning.force.com/lightning/r/Knowledg...
vendor-advisory

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mieczkowski Mateusz (rexnets)
.