{"id":"CVE-2026-90870","kind":"vulnerability","aliases":["CVE-2026-90870"],"related":[],"title":"WS_FTP Server: unreleased Ad Hoc Transfer sessions can exhaust server resources","description":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.","summary":"WS_FTP Server's Ad Hoc Transfer component does not release backend receiver sessions, so they accumulate over time. An attacker can exhaust server resources and degrade or interrupt the file transfer service.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-transfer","runtime","windows","ws_ftp-server"],"not_affected_if":["ad-hoc-transfer-unused","non-windows-host"],"how_to_check":"- Confirm the installed WS_FTP Server version and whether it runs on Windows\n- Check whether the Ad Hoc Transfer feature is in use on the server","fix":"- WS_FTP Server versions prior to `2024.0.7` and `2025.0.4` are affected; move to `2024.0.7` or later in the 2024 line, or `2025.0.4` or later in the 2025 line","status":"open","published_at":"2026-10-29T16:20:05+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:31:48+00:00","updated_at":"2026-10-29T16:31:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T16:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server versions prior to `2024.0.7` and `2025.0.4` are affected; move to `2024.0.7` or later in the 2024 line, or `2025.0.4` or later in the 2025 line","reach":"unknown","title":"WS_FTP Server: unreleased Ad Hoc Transfer sessions can exhaust server resources","impact":"low","summary":"WS_FTP Server's Ad Hoc Transfer component does not release backend receiver sessions, so they accumulate over time. An attacker can exhaust server resources and degrade or interrupt the file transfer service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ws_ftp-server","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Server resources exhausted, causing service degradation or outage","analyst_note":"","how_to_check":"- Confirm the installed WS_FTP Server version and whether it runs on Windows\n- Check whether the Ad Hoc Transfer feature is in use on the server\n","plain_action":"","needs_analyst":false,"not_affected_if":["non-windows-host","ad-hoc-transfer-unused"],"who_is_affected":"Only WS_FTP Server instances running on Windows with the Ad Hoc Transfer component are described as affected, and only versions before 2024.0.7 and 2025.0.4. Teams that do not run WS_FTP Server, or run it on other platforms, can skip it. The sources do not describe a configuration that disables the exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":4115,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90870':15A,18A '2024.0.7':83C '2025.0.4':85C 'accumul':44B 'ad':5A,32B,70C 'attack':48B 'backend':39B,65C 'compon':35B,73C 'could':88C 'cve':13A,16A 'degrad':54B,96C 'exhaust':10A,50B,93C 'file':20B,58B 'file-transf':19B 'ftp':2A,26B,29B,78C 'ftp-server':25B 'hoc':6A,33B,71C 'interrupt':56B 'lead':89C 'miss':62C 'prior':81C 'progress':75C 'receiv':40B,66C 'releas':38B,63C 'resourc':12A,52B,92C 'runtim':22B 'server':3A,11A,27B,30B,51B,79C,91C 'servic':60B,95C 'session':8A,41B,67C 'softwar':76C 'time':46B 'transfer':7A,21B,34B,59B,72C 'unreleas':4A 'version':80C 'window':23B,87C 'ws':1A,24B,28B,77C","nicknames":[],"mitigations":[],"who_affected":"Only WS_FTP Server instances running on Windows with the Ad Hoc Transfer component are described as affected, and only versions before 2024.0.7 and 2025.0.4. Teams that do not run WS_FTP Server, or run it on other platforms, can skip it. The sources do not describe a configuration that disables the exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90870","severity":null,"published_at":"2026-10-29T16:20:05+00:00","modified_at":"2026-10-29T16:24:53+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}