CVE-2026-90863: Privilege Escalation via Missing Authorization in WS_FTP Manager
Missing authorization in the administrative interface of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a delegated Host Administrator account. The issue allows that user to exceed its authorized administrative scope.
Which deployments are affected?
Progress Software WS_FTP Server installations on Windows are affected if they run a version earlier than 2024.0.7 or 2025.0.4. The provided information does not state whether any particular default configuration enables the vulnerable access path.
What could a successful attacker do?
A delegated Host Administrator could potentially achieve arbitrary command execution with elevated privileges, leading to complete compromise of the underlying server.