CVE-2026-90868: OS Command Injection in Progress WS_FTP Server
An OS command injection vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
Which deployments are affected?
The vulnerability affects Progress WS_FTP Server running on Windows in versions earlier than 2024.0.7 or 2025.0.4, under certain configurations.
What level of access does an attacker need?
The supplied severity vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. Successful exploitation could result in arbitrary command execution.
What is the impact of successful exploitation?
The vulnerability is rated critical with a 9.9 severity score. The provided vector indicates high impact to confidentiality, integrity, and availability, with impact extending beyond the vulnerable security authority.