CVE-2026-90867: Improper Access Control of Web Admin Console in Progress WS_FTP Server

Published Oct 29, 2026

Updated

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2024.0.7
Upgrade
Upgrade Progress WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.4

Event History

Oct 29, 2026

CVE Published

via MITRE·03:53 PM

Data Sourced

via MITRE·03:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

WS_FTP Server running on Windows is affected if it is earlier than version 2024.0.7 or 2025.0.4. The issue is specifically in the Web Admin console.

Can this be exploited remotely without prior authentication?

The vector is network-based and no privileges or user interaction are required according to the supplied CVSS metrics. Exploitation has high attack complexity, and the flaw exposes administrative functionality to remote authentication attempts.

What versions address the issue?

The affected versions are those prior to 2024.0.7 and 2025.0.4. Updating to the applicable listed version or later addresses the affected-version condition described.

CVE-2026-90867: Improper Access Control of Web Admin Console in Progress WS_FTP Server

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Can this be exploited remotely without prior authentication?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Can this be exploited remotely without prior authentication?

What versions address the issue?