Live › vulnerability › CVE-2026-90862
Progress WS_FTP Server's Web Transfer Module, on Windows, fails to enforce multi-factor authentication for some file access. An attacker who already has a user's password can reach files tied to that account without the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Teams running WS_FTP Server on Windows with the Web Transfer Module enabled are exposed, provided the version is below the fixed releases. The attacker needs a valid user password first, so accounts with weak or reused passwords carry the most risk. Installations on other operating systems, or on fixed versions, are not covered by this description.
No product ranges from the sources yet.
2024.0.7 and 2025.0.4.2024.0.7 on the 2024.0 line: move to 2024.0.7.2025.0.42025.0.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
This page as .md · .json · in your agent: get_signal("CVE-2026-90862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.