Live › vulnerability › CVE-2026-90872
WS_FTP Server's Manager web console on Windows fails to neutralize directives in dynamically evaluated code. An authenticated Manager administrator can execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Only Windows installs of WS_FTP Server running a version before 2024.0.7 or 2025.0.4 are exposed, and only through the Manager web console. An attacker needs a Manager administrator account, so the risk is mostly insider or compromised-admin. Servers on other platforms or with patched versions can skip it.
No product ranges from the sources yet.
2024.0.7 and 2025.0.4 are listed as affected.2024.0.7 for the 2024 line2025.0.4 for the 2025 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
This page as .md · .json · in your agent: get_signal("CVE-2026-90872")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.