Live › vulnerability › CVE-2026-90861
Progress WS_FTP Server on Windows can expose a user's password in clear text to another administrator. That administrator could use the password to gain broader control of the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
WS_FTP Server installations on Windows running versions before 2024.0.7 or 2025.0.4 are affected. The exposure is to other administrators on the server, so teams with a single administrator have less exposure. Servers on other platforms are not described as affected.
No product ranges from the sources yet.
2024.0.7 for the 2024.0 line2025.0.4 for the 2025.0 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-90861")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.