---
id: "CVE-2026-90867"
kind: "vulnerability"
aliases: ["CVE-2026-90867"]
title: "WS_FTP Server: Web Admin console access control flaw exposes admin functions"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["file-transfer", "vendor", "windows", "ws_ftp-server"]
not_affected_if: ["admin-console-not-exposed", "fixed-version"]
published_at: "2026-10-29T16:20:04+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:29:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90867", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# WS_FTP Server: Web Admin console access control flaw exposes admin functions

WS_FTP Server's Web Admin console on Windows has improper access control that can expose administrative functionality to remote authentication attempts. An attacker who reaches the console could try to log in to administrative functions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WS_FTP Server version against the fixed versions listed below.
- Confirm whether the Web Admin console is reachable from networks outside your admin network.

## Fix

- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on that branch.
- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on that branch.

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90867

## From the sources

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_