{"id":"CVE-2026-90869","kind":"vulnerability","aliases":["CVE-2026-90869"],"related":[],"title":"WS_FTP Server: SSH key holder can crash the shared SSH service","description":"A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.","summary":"WS_FTP Server on Windows has a flaw where a remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service. The result is denial of service for every user of that SSH service, not code execution or data theft.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","sftp","windows","ws_ftp_server"],"not_affected_if":["other-versions","ssh-disabled"],"how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed below.\n- Confirm whether SSH/SFTP access is enabled on the server.","fix":"- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on the 2024 line.\n- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on the 2025 line.","status":"open","published_at":"2026-10-29T16:20:05+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:29:39+00:00","updated_at":"2026-10-29T16:29:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T16:29:39Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on the 2024 line.\n- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on the 2025 line.","reach":"internet","title":"WS_FTP Server: SSH key holder can crash the shared SSH service","impact":"low","summary":"WS_FTP Server on Windows has a flaw where a remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service. The result is denial of service for every user of that SSH service, not code execution or data theft.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ws_ftp_server","windows","sftp","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"shared SSH service on the server is terminated, causing denial of service","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version against the fixed versions listed below.\n- Confirm whether SSH/SFTP access is enabled on the server.","plain_action":"","needs_analyst":false,"not_affected_if":["ssh-disabled","other-versions"],"who_is_affected":"Windows servers running WS_FTP Server earlier than 2024.0.7 or 2025.0.4 with the SSH service enabled are exposed. An attacker needs a valid account's enrolled SSH public key, which limits the risk to someone who already knows that key. Sites that do not run WS_FTP Server's SSH service can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4098,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90869':15A,18A '2024.0.7':103C '2025.0.4':105C 'account':44B,82C 'attack':39B,77C 'code':70B 'crash':8A 'cve':13A,16A 'data':73B 'denial':59B 'enrol':46B,84C 'everi':63B 'execut':71B 'flaw':35B 'ftp':2A,26B,29B,98C 'holder':6A 'host':22B 'key':5A,49B,87C 'know':41B,79C 'prior':101C 'progress':95C 'public':48B,86C 'remot':38B,76C 'result':57B 'runtim':19B 'self':21B 'self-host':20B 'server':3A,27B,30B,99C 'servic':12A,55B,61B,68B,93C 'sftp':23B 'share':10A,53B,91C 'softwar':96C 'ssh':4A,11A,47B,54B,67B,85C,92C 'termin':51B,89C 'theft':74B 'user':64B 'valid':43B,81C 'version':100C 'window':24B,32B,107C 'ws':1A,25B,28B,97C","nicknames":[],"mitigations":[],"who_affected":"Windows servers running WS_FTP Server earlier than 2024.0.7 or 2025.0.4 with the SSH service enabled are exposed. An attacker needs a valid account's enrolled SSH public key, which limits the risk to someone who already knows that key. Sites that do not run WS_FTP Server's SSH service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90869","severity":null,"published_at":"2026-10-29T16:20:05+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}