Live › vulnerability › CVE-2026-90867
WS_FTP Server's Web Admin console on Windows has improper access control that can expose administrative functionality to remote authentication attempts. An attacker who reaches the console could try to log in to administrative functions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Windows installs of WS_FTP Server that run the Web Admin console and have it reachable to remote authentication attempts are exposed. Installs on the fixed versions, or with the admin console kept off untrusted networks, are less exposed; the sources do not say more.
No product ranges from the sources yet.
2024.0.7 is affected; move to 2024.0.7 or later on that branch.2025.0.4 is affected; move to 2025.0.4 or later on that branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
This page as .md · .json · in your agent: get_signal("CVE-2026-90867")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.