{"id":"CVE-2026-90867","kind":"vulnerability","aliases":["CVE-2026-90867"],"related":[],"title":"WS_FTP Server: Web Admin console access control flaw exposes admin functions","description":"Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.","summary":"WS_FTP Server's Web Admin console on Windows has improper access control that can expose administrative functionality to remote authentication attempts. An attacker who reaches the console could try to log in to administrative functions.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","vendor","windows","ws_ftp-server"],"not_affected_if":["admin-console-not-exposed","fixed-version"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed below.\n- Confirm whether the Web Admin console is reachable from networks outside your admin network.","fix":"- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on that branch.\n- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on that branch.","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:29:35+00:00","updated_at":"2026-10-29T16:29:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-29T16:29:35Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on that branch.\n- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on that branch.","reach":"network","title":"WS_FTP Server: Web Admin console access control flaw exposes admin functions","impact":"high","summary":"WS_FTP Server's Web Admin console on Windows has improper access control that can expose administrative functionality to remote authentication attempts. An attacker who reaches the console could try to log in to administrative functions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ws_ftp-server","windows","file-transfer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reaches administrative functionality via authentication attempts","analyst_note":"Check the Progress advisory for exact exploit conditions and whether unauthenticated access is possible; sources give only the NVD summary.","how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed below.\n- Confirm whether the Web Admin console is reachable from networks outside your admin network.\n- unknown for any further check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","admin-console-not-exposed"],"who_is_affected":"Windows installs of WS_FTP Server that run the Web Admin console and have it reachable to remote authentication attempts are exposed. Installs on the fixed versions, or with the admin console kept off untrusted networks, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4101,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90867':15A,18A '2024.0.7':81C '2025.0.4':83C 'access':7A,39B,65C 'admin':5A,11A,33B,70C 'administr':44B,62B,88C 'attack':51B 'attempt':49B,93C 'authent':48B,92C 'consol':6A,34B,55B,71C 'control':8A,40B,66C 'could':56B,86C 'cve':13A,16A 'expos':10A,43B,87C 'file':20B 'file-transf':19B 'flaw':9A 'ftp':2A,26B,29B,76C 'ftp-server':25B 'function':12A,45B,63B,89C 'improp':38B,64C 'log':59B 'prior':79C 'progress':73C 'reach':53B 'remot':47B,91C 'server':3A,27B,30B,77C 'softwar':74C 'transfer':21B 'tri':57B 'vendor':22B 'version':78C 'web':4A,32B,69C 'window':23B,36B,85C 'ws':1A,24B,28B,75C","nicknames":[],"mitigations":[],"who_affected":"Windows installs of WS_FTP Server that run the Web Admin console and have it reachable to remote authentication attempts are exposed. Installs on the fixed versions, or with the admin console kept off untrusted networks, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90867","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}