CVE-2026-90861: Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

Published Oct 29, 2026

Updated

Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2024.0.7
Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.4

Event History

Oct 29, 2026

CVE Published

via MITRE·03:47 PM

Data Sourced

via MITRE·03:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Windows deployments of WS_FTP Server running versions earlier than 2024.0.7 or 2025.0.4 may be affected. Exploitation involves one administrator accessing another user's password through activity logs.

What level of access does an attacker need?

The attacker must already have administrator-level access to the WS_FTP Server environment and be able to view the relevant activity logs. The disclosed password could then be used to obtain broader administrative access.

What versions remediate the issue?

Upgrade WS_FTP Server to 2024.0.7 or 2025.0.4, as versions prior to those releases are identified as affected.

CVE-2026-90861: Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

What versions remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What level of access does an attacker need?

What versions remediate the issue?