Improper Access Control in Progress Software WS_FTP Server on Windows
CVE-2026-90867

8.1HIGH

Key Information:

Vendor

Progress Software
Status
Ws Ftp Server
Vendor
CVE Published:
29 October 2026

What is CVE-2026-90867?

A security issue in the Web Admin console of Progress Software's WS_FTP Server allows improper access control, potentially exposing sensitive administrative functionalities to unauthorized remote authentication attempts. This vulnerability affects versions of the software before 2024.0.7 and 2025.0.4 on Windows systems, underscoring the importance of timely updates and security assessments to safeguard against potential intrusions.

Affected Version(s)

WS_FTP Server Windows 0 < 2024.0.7

WS_FTP Server Windows 0 < 2025.0.4

References

https://progress.lightning.force.com/lightning/r/Knowledg...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.