---
id: "CVE-2026-90869"
kind: "vulnerability"
aliases: ["CVE-2026-90869"]
title: "WS_FTP Server: SSH key holder can crash the shared SSH service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "sftp", "windows", "ws_ftp_server"]
not_affected_if: ["other-versions", "ssh-disabled"]
published_at: "2026-10-29T16:20:05+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:29:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90869", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# WS_FTP Server: SSH key holder can crash the shared SSH service

WS_FTP Server on Windows has a flaw where a remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service. The result is denial of service for every user of that SSH service, not code execution or data theft.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WS_FTP Server version against the fixed versions listed below.
- Confirm whether SSH/SFTP access is enabled on the server.

## Fix

- WS_FTP Server prior to `2024.0.7` is affected; move to `2024.0.7` or later on the 2024 line.
- WS_FTP Server prior to `2025.0.4` is affected; move to `2025.0.4` or later on the 2025 line.

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90869

## From the sources

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_