CVE-2026-90869: Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2024.0.7 - Upgrade
Upgrade
Progress Software WS_FTP Serverto a version that resolves this vulnerability.Fixed in 2025.0.4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs network access to the SSH service and knowledge of a valid account's enrolled SSH public key. No authentication or user interaction is required.
Which deployments are affected?
The issue affects Progress Software WS_FTP Server on Windows versions earlier than 2024.0.7 and 2025.0.4. The affected SSH service is shared, so terminating it can disrupt SSH access for other users.
How can I determine whether my server is vulnerable?
Check whether the system is running WS_FTP Server on Windows and compare its version with 2024.0.7 or 2025.0.4. Versions prior to those releases are affected.