PT-2026-132331

CVE-2026-90863

Published

2026-10-29

Updated

2026-10-30

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.7 Progress Software WS FTP Server versions prior to 2025.0.4

Description Missing authorization in the administrative interface on Windows allows a delegated Host Administrator to exceed their authorized scope. This can lead to arbitrary command execution with elevated privileges, potentially resulting in a complete compromise of the underlying server.

Recommendations Update Progress Software WS FTP Server to version 2024.0.7. Update Progress Software WS FTP Server to version 2025.0.4.

Exploitability

Fix

Impacts

Researchers

Niv Levy

Vendors

Affected products

Weakness enumeration

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-862: Missing Authorization

Related identifiers