{"id":"CVE-2026-90862","kind":"vulnerability","aliases":["CVE-2026-90862"],"related":[],"title":"WS_FTP Server: Web Transfer flaw skips multi-factor authentication on Windows","description":"Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.","summary":"Progress WS_FTP Server's Web Transfer Module, on Windows, fails to enforce multi-factor authentication for some file access. An attacker who already has a user's password can reach files tied to that account without the second factor.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","vendor","windows","ws_ftp"],"not_affected_if":["fixed-version","non-windows","web-transfer-disabled"],"how_to_check":"- Check the installed WS_FTP Server version and compare it with the fixed releases `2024.0.7` and `2025.0.4`.\n- Confirm the server runs on Windows and that the Web Transfer Module is in use.\n- Check whether MFA is required for the affected accounts.","fix":"- WS_FTP Server prior to `2024.0.7` on the 2024.0 line: move to `2024.0.7`.\n- WS_FTP Server prior to `2025.0.4` on the 2025.0 line: move to `2025.0.4`.","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:31:58+00:00","updated_at":"2026-10-29T16:31:58+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-29T16:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.7` on the 2024.0 line: move to `2024.0.7`.\n- WS_FTP Server prior to `2025.0.4` on the 2025.0 line: move to `2025.0.4`.","reach":"network","title":"WS_FTP Server: Web Transfer flaw skips multi-factor authentication on Windows","impact":"medium","summary":"Progress WS_FTP Server's Web Transfer Module, on Windows, fails to enforce multi-factor authentication for some file access. An attacker who already has a user's password can reach files tied to that account without the second factor.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ws_ftp","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads account files without the second factor","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version and compare it with the fixed releases `2024.0.7` and `2025.0.4`.\n- Confirm the server runs on Windows and that the Web Transfer Module is in use.\n- Check whether MFA is required for the affected accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","non-windows","web-transfer-disabled"],"who_is_affected":"Teams running WS_FTP Server on Windows with the Web Transfer Module enabled are exposed, provided the version is below the fixed releases. The attacker needs a valid user password first, so accounts with weak or reused passwords carry the most risk. Installations on other operating systems, or on fixed versions, are not covered by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4129,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-90862':16A,19A '2024.0.7':84C '2025.0.4':86C 'access':47B,99C 'account':63B,105C 'allow':90C 'alreadi':51B 'associ':102C 'attack':49B,92C 'authent':11A,43B,69C,111C 'certain':100C 'could':89C 'cve':14A,17A 'enforc':39B 'factor':10A,42B,67B,110C 'fail':37B 'file':21B,46B,59B,101C 'file-transf':20B 'flaw':6A 'ftp':2A,26B,29B,79C 'improp':68C 'modul':34B,74C 'multi':9A,41B,109C 'multi-factor':8A,40B,108C 'password':56B,97C 'prior':82C 'progress':27B,76C 'reach':58B 'requir':112C 'satisfi':107C 'second':66B 'server':3A,30B,80C 'skip':7A 'softwar':77C 'tie':60B 'transfer':5A,22B,33B,73C 'user':54B,95C 'vendor':23B 'version':81C 'web':4A,32B,72C 'window':13A,24B,36B,88C 'without':64B,106C 'ws':1A,25B,28B,78C","nicknames":[],"mitigations":[],"who_affected":"Teams running WS_FTP Server on Windows with the Web Transfer Module enabled are exposed, provided the version is below the fixed releases. The attacker needs a valid user password first, so accounts with weak or reused passwords carry the most risk. Installations on other operating systems, or on fixed versions, are not covered by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90862","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}