---
id: "CVE-2026-90870"
kind: "vulnerability"
aliases: ["CVE-2026-90870"]
title: "WS_FTP Server: unreleased Ad Hoc Transfer sessions can exhaust server resources"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["file-transfer", "runtime", "windows", "ws_ftp-server"]
not_affected_if: ["ad-hoc-transfer-unused", "non-windows-host"]
published_at: "2026-10-29T16:20:05+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:31:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90870", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# WS_FTP Server: unreleased Ad Hoc Transfer sessions can exhaust server resources

WS_FTP Server's Ad Hoc Transfer component does not release backend receiver sessions, so they accumulate over time. An attacker can exhaust server resources and degrade or interrupt the file transfer service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed WS_FTP Server version and whether it runs on Windows
- Check whether the Ad Hoc Transfer feature is in use on the server

## Fix

- WS_FTP Server versions prior to `2024.0.7` and `2025.0.4` are affected; move to `2024.0.7` or later in the 2024 line, or `2025.0.4` or later in the 2025 line

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90870

## From the sources

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_