Live › vulnerability › CVE-2026-90865
WS_FTP Server is a file transfer product from Progress Software. An OS command injection flaw lets an attacker run arbitrary commands with elevated privileges on a Windows host under certain configurations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Only Windows installations of WS_FTP Server earlier than 2024.0.7 or 2025.0.4 are named in the sources, and the flaw needs certain configurations to be exploitable. The sources do not say which configurations or whether an account is needed, so the exact exposure is unknown; teams running WS_FTP Server on Windows should treat it as in scope.
No product ranges from the sources yet.
2024.0.7 and 2025.0.4.2024.0.7 on the 2024 branch: move to 2024.0.7 or later.2025.0.4 on the 2025 branch: move to or later.2025.0.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
This page as .md · .json · in your agent: get_signal("CVE-2026-90865")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.