Live › vulnerability › CVE-2026-90870
WS_FTP Server's Ad Hoc Transfer component does not release backend receiver sessions, so they accumulate over time. An attacker can exhaust server resources and degrade or interrupt the file transfer service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Only WS_FTP Server instances running on Windows with the Ad Hoc Transfer component are described as affected, and only versions before 2024.0.7 and 2025.0.4. Teams that do not run WS_FTP Server, or run it on other platforms, can skip it. The sources do not describe a configuration that disables the exposure.
No product ranges from the sources yet.
2024.0.7 and 2025.0.4 are affected; move to 2024.0.7 or later in the 2024 line, or 2025.0.4 or later in the 2025 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
This page as .md · .json · in your agent: get_signal("CVE-2026-90870")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.