CVE-2026-90870: Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

Published Oct 29, 2026

Updated

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress Software WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2024.0.7
Upgrade
Upgrade Progress Software WS_FTP Server to a version that resolves this vulnerability.
Fixed in 2025.0.4

Event History

Oct 29, 2026

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Progress WS_FTP Server on Windows is affected when running a version prior to 2024.0.7 or 2025.0.4. The issue is in the Ad Hoc Transfer component.

Does an attacker need credentials or user interaction to trigger the issue?

No. The vulnerability is unauthenticated and can be triggered remotely without user interaction.

What is the likely operational impact?

Failure to release backend receiver sessions can exhaust server resources, causing service degradation. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-90870: Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need credentials or user interaction to trigger the issue?

What is the likely operational impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need credentials or user interaction to trigger the issue?

What is the likely operational impact?