Live › vulnerability › CVE-2026-90868
WS_FTP Server, Progress Software's file transfer server, has an OS command injection flaw on Windows under certain configurations. An attacker who can reach the server can get arbitrary commands executed on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Organizations running WS_FTP Server on Windows at the affected versions, where the flaw applies under certain configurations the sources do not detail. Systems on fixed versions or on non-Windows platforms are not described as affected.
No product ranges from the sources yet.
2024.0.7: move to 2024.0.7 or later.2025.x prior to 2025.0.4: move to 2025.0.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
This page as .md · .json · in your agent: get_signal("CVE-2026-90868")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.