---
id: "CVE-2026-90868"
kind: "vulnerability"
aliases: ["CVE-2026-90868"]
title: "WS_FTP Server: OS command injection lets attackers run commands on Windows"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["file-transfer", "infrastructure", "windows", "ws_ftp"]
not_affected_if: ["fixed-version", "non-windows"]
published_at: "2026-10-29T16:20:04+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:27:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90868", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# WS_FTP Server: OS command injection lets attackers run commands on Windows

WS_FTP Server, Progress Software's file transfer server, has an OS command injection flaw on Windows under certain configurations. An attacker who can reach the server can get arbitrary commands executed on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WS_FTP Server version against the fixed releases listed in Fix.
- Review the server configuration for the setting the sources do not name; unknown whether any specific configuration is required beyond the Windows install.

## Fix

- WS_FTP Server prior to `2024.0.7`: move to `2024.0.7` or later.
- WS_FTP Server `2025.x` prior to `2025.0.4`: move to `2025.0.4` or later.

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90868

## From the sources

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_