CVE-2026-90862: Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid user's password. Exploitation also requires interaction by the user, as reflected in the CVSS vector.
Which deployments are affected?
The issue affects the Web Transfer Module in Progress WS_FTP Server on Windows. Versions earlier than 2024.0.7 and 2025.0.4 are affected.
Does this expose every resource in the affected account?
The available information states that an attacker may access certain files associated with the account. It does not indicate that all account resources or server functions are accessible.