{"id":"CVE-2026-90865","kind":"vulnerability","aliases":["CVE-2026-90865"],"related":[],"title":"WS_FTP Server: OS command injection lets attackers run commands on Windows","description":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.","summary":"WS_FTP Server is a file transfer product from Progress Software. An OS command injection flaw lets an attacker run arbitrary commands with elevated privileges on a Windows host under certain configurations.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","package","windows","ws_ftp_server"],"not_affected_if":["non-windows-host"],"how_to_check":"- Check the installed WS_FTP Server version in the product's About or admin console and compare it to `2024.0.7` and `2025.0.4`.\n- Confirm whether the server runs on Windows and which configuration the sources' 'certain configurations' refers to: unknown.","fix":"- WS_FTP Server prior to `2024.0.7` on the 2024 branch: move to `2024.0.7` or later.\n- WS_FTP Server prior to `2025.0.4` on the 2025 branch: move to `2025.0.4` or later.","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:02+00:00","triaged_at":"2026-10-29T16:27:51+00:00","updated_at":"2026-10-29T16:27:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.7` on the 2024 branch: move to `2024.0.7` or later.\n- WS_FTP Server prior to `2025.0.4` on the 2025 branch: move to `2025.0.4` or later.","reach":"unknown","title":"WS_FTP Server: OS command injection lets attackers run commands on Windows","impact":"high","summary":"WS_FTP Server is a file transfer product from Progress Software. An OS command injection flaw lets an attacker run arbitrary commands with elevated privileges on a Windows host under certain configurations.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ws_ftp_server","windows","file-transfer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Arbitrary commands run on the Windows host with elevated privileges.","analyst_note":"Find the Progress advisory for CVE-2026-90865 to confirm the affected configurations, whether authentication is needed, and the exact fixed versions.","how_to_check":"- Check the installed WS_FTP Server version in the product's About or admin console and compare it to `2024.0.7` and `2025.0.4`.\n- Confirm whether the server runs on Windows and which configuration the sources' 'certain configurations' refers to: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["non-windows-host"],"who_is_affected":"Only Windows installations of WS_FTP Server earlier than 2024.0.7 or 2025.0.4 are named in the sources, and the flaw needs certain configurations to be exploitable. The sources do not say which configurations or whether an account is needed, so the exact exposure is unknown; teams running WS_FTP Server on Windows should treat it as in scope.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4113,"output_tokens":666,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90865':15A,18A '2024.0.7':73C '2025.0.4':75C 'allow':79C 'arbitrari':47B,80C 'attack':8A,45B 'certain':57B,87C 'command':5A,10A,40B,48B,61C,81C 'configur':58B,88C 'could':78C 'cve':13A,16A 'elev':50B,84C 'execut':82C 'file':20B,32B 'file-transf':19B 'flaw':42B 'ftp':2A,25B,28B,68C 'host':55B 'inject':6A,41B,62C 'let':7A,43B 'os':4A,39B,60C 'packag':22B 'prior':71C 'privileg':51B,85C 'product':34B 'progress':36B,65C 'run':9A,46B 'server':3A,26B,29B,69C 'softwar':37B,66C 'transfer':21B,33B 'version':70C 'vulner':63C 'window':12A,23B,54B,77C 'ws':1A,24B,27B,67C","nicknames":[],"mitigations":[],"who_affected":"Only Windows installations of WS_FTP Server earlier than 2024.0.7 or 2025.0.4 are named in the sources, and the flaw needs certain configurations to be exploitable. The sources do not say which configurations or whether an account is needed, so the exact exposure is unknown; teams running WS_FTP Server on Windows should treat it as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90865","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:02+00:00","fetched_at":"2026-10-29T16:26:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}