Live › vulnerability › CVE-2026-90869
WS_FTP Server on Windows has a flaw where a remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service. The result is denial of service for every user of that SSH service, not code execution or data theft.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Windows servers running WS_FTP Server earlier than 2024.0.7 or 2025.0.4 with the SSH service enabled are exposed. An attacker needs a valid account's enrolled SSH public key, which limits the risk to someone who already knows that key. Sites that do not run WS_FTP Server's SSH service can skip it.
No product ranges from the sources yet.
2024.0.7 is affected; move to 2024.0.7 or later on the 2024 line.2025.0.4 is affected; move to 2025.0.4 or later on the 2025 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
This page as .md · .json · in your agent: get_signal("CVE-2026-90869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.