{"id":"CVE-2026-90868","kind":"vulnerability","aliases":["CVE-2026-90868"],"related":[],"title":"WS_FTP Server: OS command injection lets attackers run commands on Windows","description":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.","summary":"WS_FTP Server, Progress Software's file transfer server, has an OS command injection flaw on Windows under certain configurations. An attacker who can reach the server can get arbitrary commands executed on the host.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","infrastructure","windows","ws_ftp"],"not_affected_if":["fixed-version","non-windows"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed releases listed in Fix.\n- Review the server configuration for the setting the sources do not name; unknown whether any specific configuration is required beyond the Windows install.","fix":"- WS_FTP Server prior to `2024.0.7`: move to `2024.0.7` or later.\n- WS_FTP Server `2025.x` prior to `2025.0.4`: move to `2025.0.4` or later.","status":"open","published_at":"2026-10-29T16:20:04+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:27:07+00:00","updated_at":"2026-10-29T16:27:07+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T16:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.7`: move to `2024.0.7` or later.\n- WS_FTP Server `2025.x` prior to `2025.0.4`: move to `2025.0.4` or later.","reach":"unknown","title":"WS_FTP Server: OS command injection lets attackers run commands on Windows","impact":"high","summary":"WS_FTP Server, Progress Software's file transfer server, has an OS command injection flaw on Windows under certain configurations. An attacker who can reach the server can get arbitrary commands executed on the host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ws_ftp","windows","file-transfer"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Arbitrary commands execute on the Windows server host.","analyst_note":"Check the Progress advisory for the exact configuration that triggers the flaw and whether the attack is network-reachable without credentials.","how_to_check":"- Check the installed WS_FTP Server version against the fixed releases listed in Fix.\n- Review the server configuration for the setting the sources do not name; unknown whether any specific configuration is required beyond the Windows install.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","non-windows"],"who_is_affected":"Organizations running WS_FTP Server on Windows at the affected versions, where the flaw applies under certain configurations the sources do not detail. Systems on fixed versions or on non-Windows platforms are not described as affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000704,"input_tokens":4106,"output_tokens":586,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90868':15A,18A '2024.0.7':75C '2025.0.4':77C 'allow':81C 'arbitrari':55B,82C 'attack':8A,47B 'certain':44B,86C 'command':5A,10A,38B,56B,63C,83C 'configur':45B,87C 'could':80C 'cve':13A,16A 'execut':57B,84C 'file':20B,32B 'file-transf':19B 'flaw':40B 'ftp':2A,25B,27B,70C 'get':54B 'host':60B 'infrastructur':22B 'inject':6A,39B,64C 'let':7A 'os':4A,37B,62C 'prior':73C 'progress':29B,67C 'reach':50B 'run':9A 'server':3A,28B,34B,52B,71C 'softwar':30B,68C 'transfer':21B,33B 'version':72C 'vulner':65C 'window':12A,23B,42B,79C 'ws':1A,24B,26B,69C","nicknames":[],"mitigations":[],"who_affected":"Organizations running WS_FTP Server on Windows at the affected versions, where the flaw applies under certain configurations the sources do not detail. Systems on fixed versions or on non-Windows platforms are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90868","severity":null,"published_at":"2026-10-29T16:20:04+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}