Live › vulnerability › CVE-2026-90863
WS_FTP Server on Windows lacks an authorization check in its administrative interface, so a delegated Host Administrator can act beyond their assigned scope. The sources say this could allow arbitrary command execution with elevated privileges and full compromise of the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Only Windows installations of WS_FTP Server prior to 2024.0.7 and 2025.0.4 are described as affected. The exposure depends on the delegated Host Administrator role, so a server with no delegated host administrators is less exposed, though the sources do not say how much less. unknown whether the flaw is reachable from the internet by default.
No product ranges from the sources yet.
2024.0.7 and below 2025.0.42024.0.7 and below 2025.0.4: move to the fixed release for your branch (2024.0.7 or )2025.0.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
This page as .md · .json · in your agent: get_signal("CVE-2026-90863")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.